xref: /linux/drivers/gpu/drm/radeon/evergreen_cs.c (revision 2c142b63c8ee982cdfdba49a616027c266294838)
1 /*
2  * Copyright 2010 Advanced Micro Devices, Inc.
3  * Copyright 2008 Red Hat Inc.
4  * Copyright 2009 Jerome Glisse.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a
7  * copy of this software and associated documentation files (the "Software"),
8  * to deal in the Software without restriction, including without limitation
9  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
10  * and/or sell copies of the Software, and to permit persons to whom the
11  * Software is furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
19  * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
22  * OTHER DEALINGS IN THE SOFTWARE.
23  *
24  * Authors: Dave Airlie
25  *          Alex Deucher
26  *          Jerome Glisse
27  */
28 
29 #include "radeon.h"
30 #include "radeon_asic.h"
31 #include "r600.h"
32 #include "evergreend.h"
33 #include "evergreen_reg_safe.h"
34 #include "cayman_reg_safe.h"
35 
36 #ifndef MIN
37 #define MAX(a, b)                   (((a) > (b)) ? (a) : (b))
38 #define MIN(a, b)                   (((a) < (b)) ? (a) : (b))
39 #endif
40 
41 #define REG_SAFE_BM_SIZE ARRAY_SIZE(evergreen_reg_safe_bm)
42 
43 struct evergreen_cs_track {
44 	u32			group_size;
45 	u32			nbanks;
46 	u32			npipes;
47 	u32			row_size;
48 	/* value we track */
49 	u32			nsamples;		/* unused */
50 	struct radeon_bo	*cb_color_bo[12];
51 	u32			cb_color_bo_offset[12];
52 	struct radeon_bo	*cb_color_fmask_bo[8];	/* unused */
53 	struct radeon_bo	*cb_color_cmask_bo[8];	/* unused */
54 	u32			cb_color_info[12];
55 	u32			cb_color_view[12];
56 	u32			cb_color_pitch[12];
57 	u32			cb_color_slice[12];
58 	u32			cb_color_slice_idx[12];
59 	u32			cb_color_attrib[12];
60 	u32			cb_color_cmask_slice[8];/* unused */
61 	u32			cb_color_fmask_slice[8];/* unused */
62 	u32			cb_target_mask;
63 	u32			cb_shader_mask; /* unused */
64 	u32			vgt_strmout_config;
65 	u32			vgt_strmout_buffer_config;
66 	struct radeon_bo	*vgt_strmout_bo[4];
67 	u32			vgt_strmout_bo_offset[4];
68 	u32			vgt_strmout_size[4];
69 	u32			db_depth_control;
70 	u32			db_depth_view;
71 	u32			db_depth_slice;
72 	u32			db_depth_size;
73 	u32			db_z_info;
74 	u32			db_z_read_offset;
75 	u32			db_z_write_offset;
76 	struct radeon_bo	*db_z_read_bo;
77 	struct radeon_bo	*db_z_write_bo;
78 	u32			db_s_info;
79 	u32			db_s_read_offset;
80 	u32			db_s_write_offset;
81 	struct radeon_bo	*db_s_read_bo;
82 	struct radeon_bo	*db_s_write_bo;
83 	bool			sx_misc_kill_all_prims;
84 	bool			cb_dirty;
85 	bool			db_dirty;
86 	bool			streamout_dirty;
87 	u32			htile_offset;
88 	u32			htile_surface;
89 	struct radeon_bo	*htile_bo;
90 	unsigned long		indirect_draw_buffer_size;
91 	const unsigned		*reg_safe_bm;
92 };
93 
evergreen_cs_get_aray_mode(u32 tiling_flags)94 static u32 evergreen_cs_get_aray_mode(u32 tiling_flags)
95 {
96 	if (tiling_flags & RADEON_TILING_MACRO)
97 		return ARRAY_2D_TILED_THIN1;
98 	else if (tiling_flags & RADEON_TILING_MICRO)
99 		return ARRAY_1D_TILED_THIN1;
100 	else
101 		return ARRAY_LINEAR_GENERAL;
102 }
103 
evergreen_cs_get_num_banks(u32 nbanks)104 static u32 evergreen_cs_get_num_banks(u32 nbanks)
105 {
106 	switch (nbanks) {
107 	case 2:
108 		return ADDR_SURF_2_BANK;
109 	case 4:
110 		return ADDR_SURF_4_BANK;
111 	case 8:
112 	default:
113 		return ADDR_SURF_8_BANK;
114 	case 16:
115 		return ADDR_SURF_16_BANK;
116 	}
117 }
118 
evergreen_cs_track_init(struct evergreen_cs_track * track)119 static void evergreen_cs_track_init(struct evergreen_cs_track *track)
120 {
121 	int i;
122 
123 	for (i = 0; i < 8; i++) {
124 		track->cb_color_fmask_bo[i] = NULL;
125 		track->cb_color_cmask_bo[i] = NULL;
126 		track->cb_color_cmask_slice[i] = 0;
127 		track->cb_color_fmask_slice[i] = 0;
128 	}
129 
130 	for (i = 0; i < 12; i++) {
131 		track->cb_color_bo[i] = NULL;
132 		track->cb_color_bo_offset[i] = 0xFFFFFFFF;
133 		track->cb_color_info[i] = 0;
134 		track->cb_color_view[i] = 0xFFFFFFFF;
135 		track->cb_color_pitch[i] = 0;
136 		track->cb_color_slice[i] = 0xfffffff;
137 		track->cb_color_slice_idx[i] = 0;
138 	}
139 	track->cb_target_mask = 0xFFFFFFFF;
140 	track->cb_shader_mask = 0xFFFFFFFF;
141 	track->cb_dirty = true;
142 
143 	track->db_depth_slice = 0xffffffff;
144 	track->db_depth_view = 0xFFFFC000;
145 	track->db_depth_size = 0xFFFFFFFF;
146 	track->db_depth_control = 0xFFFFFFFF;
147 	track->db_z_info = 0xFFFFFFFF;
148 	track->db_z_read_offset = 0xFFFFFFFF;
149 	track->db_z_write_offset = 0xFFFFFFFF;
150 	track->db_z_read_bo = NULL;
151 	track->db_z_write_bo = NULL;
152 	track->db_s_info = 0xFFFFFFFF;
153 	track->db_s_read_offset = 0xFFFFFFFF;
154 	track->db_s_write_offset = 0xFFFFFFFF;
155 	track->db_s_read_bo = NULL;
156 	track->db_s_write_bo = NULL;
157 	track->db_dirty = true;
158 	track->htile_bo = NULL;
159 	track->htile_offset = 0xFFFFFFFF;
160 	track->htile_surface = 0;
161 
162 	for (i = 0; i < 4; i++) {
163 		track->vgt_strmout_size[i] = 0;
164 		track->vgt_strmout_bo[i] = NULL;
165 		track->vgt_strmout_bo_offset[i] = 0xFFFFFFFF;
166 	}
167 	track->streamout_dirty = true;
168 	track->sx_misc_kill_all_prims = false;
169 }
170 
171 struct eg_surface {
172 	/* value gathered from cs */
173 	unsigned	nbx;
174 	unsigned	nby;
175 	unsigned	format;
176 	unsigned	mode;
177 	unsigned	nbanks;
178 	unsigned	bankw;
179 	unsigned	bankh;
180 	unsigned	tsplit;
181 	unsigned	mtilea;
182 	unsigned	nsamples;
183 	/* output value */
184 	unsigned	bpe;
185 	unsigned	layer_size;
186 	unsigned	palign;
187 	unsigned	halign;
188 	unsigned long	base_align;
189 };
190 
evergreen_surface_check_linear(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)191 static int evergreen_surface_check_linear(struct radeon_cs_parser *p,
192 					  struct eg_surface *surf,
193 					  const char *prefix)
194 {
195 	surf->layer_size = surf->nbx * surf->nby * surf->bpe * surf->nsamples;
196 	surf->base_align = surf->bpe;
197 	surf->palign = 1;
198 	surf->halign = 1;
199 	return 0;
200 }
201 
evergreen_surface_check_linear_aligned(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)202 static int evergreen_surface_check_linear_aligned(struct radeon_cs_parser *p,
203 						  struct eg_surface *surf,
204 						  const char *prefix)
205 {
206 	struct evergreen_cs_track *track = p->track;
207 	unsigned palign;
208 
209 	palign = MAX(64, track->group_size / surf->bpe);
210 	surf->layer_size = surf->nbx * surf->nby * surf->bpe * surf->nsamples;
211 	surf->base_align = track->group_size;
212 	surf->palign = palign;
213 	surf->halign = 1;
214 	if ((surf->nbx & (palign - 1)) && !(palign == 64 && surf->nbx == 32)) {
215 		if (prefix) {
216 			dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d\n",
217 				 __func__, __LINE__, prefix, surf->nbx, palign);
218 		}
219 		return -EINVAL;
220 	}
221 	return 0;
222 }
223 
evergreen_surface_check_1d(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)224 static int evergreen_surface_check_1d(struct radeon_cs_parser *p,
225 				      struct eg_surface *surf,
226 				      const char *prefix)
227 {
228 	struct evergreen_cs_track *track = p->track;
229 	unsigned palign;
230 
231 	palign = track->group_size / (8 * surf->bpe * surf->nsamples);
232 	palign = MAX(8, palign);
233 	surf->layer_size = surf->nbx * surf->nby * surf->bpe;
234 	surf->base_align = track->group_size;
235 	surf->palign = palign;
236 	surf->halign = 8;
237 	if ((surf->nbx & (palign - 1))) {
238 		if (prefix) {
239 			dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d (%d %d %d)\n",
240 				 __func__, __LINE__, prefix, surf->nbx, palign,
241 				 track->group_size, surf->bpe, surf->nsamples);
242 		}
243 		return -EINVAL;
244 	}
245 	if ((surf->nby & (8 - 1))) {
246 		if (prefix) {
247 			dev_warn(p->dev, "%s:%d %s height %d invalid must be aligned with 8\n",
248 				 __func__, __LINE__, prefix, surf->nby);
249 		}
250 		return -EINVAL;
251 	}
252 	return 0;
253 }
254 
evergreen_surface_check_2d(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)255 static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
256 				      struct eg_surface *surf,
257 				      const char *prefix)
258 {
259 	struct evergreen_cs_track *track = p->track;
260 	unsigned palign, halign, tileb, slice_pt;
261 	unsigned mtile_pr, mtile_ps, mtileb;
262 
263 	tileb = 64 * surf->bpe * surf->nsamples;
264 	slice_pt = 1;
265 	if (tileb > surf->tsplit) {
266 		slice_pt = tileb / surf->tsplit;
267 	}
268 	tileb = tileb / slice_pt;
269 	/* macro tile width & height */
270 	palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
271 	halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
272 	mtileb = (palign / 8) * (halign / 8) * tileb;
273 	mtile_pr = surf->nbx / palign;
274 	mtile_ps = (mtile_pr * surf->nby) / halign;
275 	surf->layer_size = mtile_ps * mtileb * slice_pt;
276 	surf->base_align = (palign / 8) * (halign / 8) * tileb;
277 	surf->palign = palign;
278 	surf->halign = halign;
279 
280 	if ((surf->nbx & (palign - 1))) {
281 		if (prefix) {
282 			dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d\n",
283 				 __func__, __LINE__, prefix, surf->nbx, palign);
284 		}
285 		return -EINVAL;
286 	}
287 	if ((surf->nby & (halign - 1))) {
288 		if (prefix) {
289 			dev_warn(p->dev, "%s:%d %s height %d invalid must be aligned with %d\n",
290 				 __func__, __LINE__, prefix, surf->nby, halign);
291 		}
292 		return -EINVAL;
293 	}
294 
295 	return 0;
296 }
297 
evergreen_surface_check(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)298 static int evergreen_surface_check(struct radeon_cs_parser *p,
299 				   struct eg_surface *surf,
300 				   const char *prefix)
301 {
302 	/* some common value computed here */
303 	surf->bpe = r600_fmt_get_blocksize(surf->format);
304 
305 	switch (surf->mode) {
306 	case ARRAY_LINEAR_GENERAL:
307 		return evergreen_surface_check_linear(p, surf, prefix);
308 	case ARRAY_LINEAR_ALIGNED:
309 		return evergreen_surface_check_linear_aligned(p, surf, prefix);
310 	case ARRAY_1D_TILED_THIN1:
311 		return evergreen_surface_check_1d(p, surf, prefix);
312 	case ARRAY_2D_TILED_THIN1:
313 		return evergreen_surface_check_2d(p, surf, prefix);
314 	default:
315 		if (prefix) {
316 			dev_warn(p->dev, "%s:%d %s invalid array mode %d\n",
317 					__func__, __LINE__, prefix, surf->mode);
318 		}
319 		return -EINVAL;
320 	}
321 	return -EINVAL;
322 }
323 
evergreen_surface_value_conv_check(struct radeon_cs_parser * p,struct eg_surface * surf,const char * prefix)324 static int evergreen_surface_value_conv_check(struct radeon_cs_parser *p,
325 					      struct eg_surface *surf,
326 					      const char *prefix)
327 {
328 	switch (surf->mode) {
329 	case ARRAY_2D_TILED_THIN1:
330 		break;
331 	case ARRAY_LINEAR_GENERAL:
332 	case ARRAY_LINEAR_ALIGNED:
333 	case ARRAY_1D_TILED_THIN1:
334 		return 0;
335 	default:
336 		dev_warn(p->dev, "%s:%d %s invalid array mode %d\n",
337 				__func__, __LINE__, prefix, surf->mode);
338 		return -EINVAL;
339 	}
340 
341 	switch (surf->nbanks) {
342 	case 0: surf->nbanks = 2; break;
343 	case 1: surf->nbanks = 4; break;
344 	case 2: surf->nbanks = 8; break;
345 	case 3: surf->nbanks = 16; break;
346 	default:
347 		dev_warn(p->dev, "%s:%d %s invalid number of banks %d\n",
348 			 __func__, __LINE__, prefix, surf->nbanks);
349 		return -EINVAL;
350 	}
351 	switch (surf->bankw) {
352 	case 0: surf->bankw = 1; break;
353 	case 1: surf->bankw = 2; break;
354 	case 2: surf->bankw = 4; break;
355 	case 3: surf->bankw = 8; break;
356 	default:
357 		dev_warn(p->dev, "%s:%d %s invalid bankw %d\n",
358 			 __func__, __LINE__, prefix, surf->bankw);
359 		return -EINVAL;
360 	}
361 	switch (surf->bankh) {
362 	case 0: surf->bankh = 1; break;
363 	case 1: surf->bankh = 2; break;
364 	case 2: surf->bankh = 4; break;
365 	case 3: surf->bankh = 8; break;
366 	default:
367 		dev_warn(p->dev, "%s:%d %s invalid bankh %d\n",
368 			 __func__, __LINE__, prefix, surf->bankh);
369 		return -EINVAL;
370 	}
371 	switch (surf->mtilea) {
372 	case 0: surf->mtilea = 1; break;
373 	case 1: surf->mtilea = 2; break;
374 	case 2: surf->mtilea = 4; break;
375 	case 3: surf->mtilea = 8; break;
376 	default:
377 		dev_warn(p->dev, "%s:%d %s invalid macro tile aspect %d\n",
378 			 __func__, __LINE__, prefix, surf->mtilea);
379 		return -EINVAL;
380 	}
381 	switch (surf->tsplit) {
382 	case 0: surf->tsplit = 64; break;
383 	case 1: surf->tsplit = 128; break;
384 	case 2: surf->tsplit = 256; break;
385 	case 3: surf->tsplit = 512; break;
386 	case 4: surf->tsplit = 1024; break;
387 	case 5: surf->tsplit = 2048; break;
388 	case 6: surf->tsplit = 4096; break;
389 	default:
390 		dev_warn(p->dev, "%s:%d %s invalid tile split %d\n",
391 			 __func__, __LINE__, prefix, surf->tsplit);
392 		return -EINVAL;
393 	}
394 	return 0;
395 }
396 
evergreen_cs_track_validate_cb(struct radeon_cs_parser * p,unsigned id)397 static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned id)
398 {
399 	struct evergreen_cs_track *track = p->track;
400 	struct eg_surface surf;
401 	unsigned pitch, slice, mslice;
402 	u64 offset;
403 	int r;
404 
405 	mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
406 	pitch = track->cb_color_pitch[id];
407 	slice = track->cb_color_slice[id];
408 	surf.nbx = (pitch + 1) * 8;
409 	surf.nby = ((slice + 1) * 64) / surf.nbx;
410 	surf.mode = G_028C70_ARRAY_MODE(track->cb_color_info[id]);
411 	surf.format = G_028C70_FORMAT(track->cb_color_info[id]);
412 	surf.tsplit = G_028C74_TILE_SPLIT(track->cb_color_attrib[id]);
413 	surf.nbanks = G_028C74_NUM_BANKS(track->cb_color_attrib[id]);
414 	surf.bankw = G_028C74_BANK_WIDTH(track->cb_color_attrib[id]);
415 	surf.bankh = G_028C74_BANK_HEIGHT(track->cb_color_attrib[id]);
416 	surf.mtilea = G_028C74_MACRO_TILE_ASPECT(track->cb_color_attrib[id]);
417 	surf.nsamples = 1;
418 
419 	if (!r600_fmt_is_valid_color(surf.format)) {
420 		dev_warn(p->dev, "%s:%d cb invalid format %d for %d (0x%08x)\n",
421 			 __func__, __LINE__, surf.format,
422 			id, track->cb_color_info[id]);
423 		return -EINVAL;
424 	}
425 
426 	r = evergreen_surface_value_conv_check(p, &surf, "cb");
427 	if (r) {
428 		return r;
429 	}
430 
431 	r = evergreen_surface_check(p, &surf, "cb");
432 	if (r) {
433 		dev_warn(p->dev, "%s:%d cb[%d] invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
434 			 __func__, __LINE__, id, track->cb_color_pitch[id],
435 			 track->cb_color_slice[id], track->cb_color_attrib[id],
436 			 track->cb_color_info[id]);
437 		return r;
438 	}
439 
440 	offset = (u64)track->cb_color_bo_offset[id] << 8;
441 	if (offset & (surf.base_align - 1)) {
442 		dev_warn(p->dev, "%s:%d cb[%d] bo base %llu not aligned with %ld\n",
443 			 __func__, __LINE__, id, offset, surf.base_align);
444 		return -EINVAL;
445 	}
446 
447 	offset += (u64)surf.layer_size * mslice;
448 	if (offset > radeon_bo_size(track->cb_color_bo[id])) {
449 		/* old ddx are broken they allocate bo with w*h*bpp but
450 		 * program slice with ALIGN(h, 8), catch this and patch
451 		 * command stream.
452 		 */
453 		if (!surf.mode) {
454 			uint32_t *ib = p->ib.ptr;
455 			u64 tmp, nby, bsize, size, min = 0;
456 
457 			/* find the height the ddx wants */
458 			if (surf.nby > 8) {
459 				min = surf.nby - 8;
460 			}
461 			bsize = radeon_bo_size(track->cb_color_bo[id]);
462 			tmp = (u64)track->cb_color_bo_offset[id] << 8;
463 			for (nby = surf.nby; nby > min; nby--) {
464 				size = nby * surf.nbx * surf.bpe * surf.nsamples;
465 				if ((tmp + size * mslice) <= bsize) {
466 					break;
467 				}
468 			}
469 			if (nby > min) {
470 				surf.nby = nby;
471 				slice = ((nby * surf.nbx) / 64) - 1;
472 				if (!evergreen_surface_check(p, &surf, "cb")) {
473 					/* check if this one works */
474 					tmp += (u64)surf.layer_size * mslice;
475 					if (tmp <= bsize) {
476 						ib[track->cb_color_slice_idx[id]] = slice;
477 						goto old_ddx_ok;
478 					}
479 				}
480 			}
481 		}
482 		dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
483 			 "offset %llu, max layer %d, bo size %ld, slice %d)\n",
484 			 __func__, __LINE__, id, surf.layer_size,
485 			(u64)track->cb_color_bo_offset[id] << 8, mslice,
486 			radeon_bo_size(track->cb_color_bo[id]), slice);
487 		dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
488 			 __func__, __LINE__, surf.nbx, surf.nby,
489 			surf.mode, surf.bpe, surf.nsamples,
490 			surf.bankw, surf.bankh,
491 			surf.tsplit, surf.mtilea);
492 		return -EINVAL;
493 	}
494 old_ddx_ok:
495 
496 	return 0;
497 }
498 
evergreen_cs_track_validate_htile(struct radeon_cs_parser * p,unsigned nbx,unsigned nby)499 static int evergreen_cs_track_validate_htile(struct radeon_cs_parser *p,
500 						unsigned nbx, unsigned nby)
501 {
502 	struct evergreen_cs_track *track = p->track;
503 	unsigned long size;
504 
505 	if (track->htile_bo == NULL) {
506 		dev_warn(p->dev, "%s:%d htile enabled without htile surface 0x%08x\n",
507 				__func__, __LINE__, track->db_z_info);
508 		return -EINVAL;
509 	}
510 
511 	if (G_028ABC_LINEAR(track->htile_surface)) {
512 		/* pitch must be 16 htiles aligned == 16 * 8 pixel aligned */
513 		nbx = round_up(nbx, 16 * 8);
514 		/* height is npipes htiles aligned == npipes * 8 pixel aligned */
515 		nby = round_up(nby, track->npipes * 8);
516 	} else {
517 		/* always assume 8x8 htile */
518 		/* align is htile align * 8, htile align vary according to
519 		 * number of pipe and tile width and nby
520 		 */
521 		switch (track->npipes) {
522 		case 8:
523 			/* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
524 			nbx = round_up(nbx, 64 * 8);
525 			nby = round_up(nby, 64 * 8);
526 			break;
527 		case 4:
528 			/* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
529 			nbx = round_up(nbx, 64 * 8);
530 			nby = round_up(nby, 32 * 8);
531 			break;
532 		case 2:
533 			/* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
534 			nbx = round_up(nbx, 32 * 8);
535 			nby = round_up(nby, 32 * 8);
536 			break;
537 		case 1:
538 			/* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
539 			nbx = round_up(nbx, 32 * 8);
540 			nby = round_up(nby, 16 * 8);
541 			break;
542 		default:
543 			dev_warn(p->dev, "%s:%d invalid num pipes %d\n",
544 					__func__, __LINE__, track->npipes);
545 			return -EINVAL;
546 		}
547 	}
548 	/* compute number of htile */
549 	nbx = nbx >> 3;
550 	nby = nby >> 3;
551 	/* size must be aligned on npipes * 2K boundary */
552 	size = roundup(nbx * nby * 4, track->npipes * (2 << 10));
553 	size += track->htile_offset;
554 
555 	if (size > radeon_bo_size(track->htile_bo)) {
556 		dev_warn(p->dev, "%s:%d htile surface too small %ld for %ld (%d %d)\n",
557 				__func__, __LINE__, radeon_bo_size(track->htile_bo),
558 				size, nbx, nby);
559 		return -EINVAL;
560 	}
561 	return 0;
562 }
563 
evergreen_cs_track_validate_stencil(struct radeon_cs_parser * p)564 static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
565 {
566 	struct evergreen_cs_track *track = p->track;
567 	struct eg_surface surf;
568 	unsigned pitch, slice, mslice;
569 	u64 offset;
570 	int r;
571 
572 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
573 	pitch = G_028058_PITCH_TILE_MAX(track->db_depth_size);
574 	slice = track->db_depth_slice;
575 	surf.nbx = (pitch + 1) * 8;
576 	surf.nby = ((slice + 1) * 64) / surf.nbx;
577 	surf.mode = G_028040_ARRAY_MODE(track->db_z_info);
578 	surf.format = G_028044_FORMAT(track->db_s_info);
579 	surf.tsplit = G_028044_TILE_SPLIT(track->db_s_info);
580 	surf.nbanks = G_028040_NUM_BANKS(track->db_z_info);
581 	surf.bankw = G_028040_BANK_WIDTH(track->db_z_info);
582 	surf.bankh = G_028040_BANK_HEIGHT(track->db_z_info);
583 	surf.mtilea = G_028040_MACRO_TILE_ASPECT(track->db_z_info);
584 	surf.nsamples = 1;
585 
586 	if (surf.format != 1) {
587 		dev_warn(p->dev, "%s:%d stencil invalid format %d\n",
588 			 __func__, __LINE__, surf.format);
589 		return -EINVAL;
590 	}
591 	/* replace by color format so we can use same code */
592 	surf.format = V_028C70_COLOR_8;
593 
594 	r = evergreen_surface_value_conv_check(p, &surf, "stencil");
595 	if (r) {
596 		return r;
597 	}
598 
599 	r = evergreen_surface_check(p, &surf, NULL);
600 	if (r) {
601 		/* old userspace doesn't compute proper depth/stencil alignment
602 		 * check that alignment against a bigger byte per elements and
603 		 * only report if that alignment is wrong too.
604 		 */
605 		surf.format = V_028C70_COLOR_8_8_8_8;
606 		r = evergreen_surface_check(p, &surf, "stencil");
607 		if (r) {
608 			dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
609 				 __func__, __LINE__, track->db_depth_size,
610 				 track->db_depth_slice, track->db_s_info, track->db_z_info);
611 		}
612 		return r;
613 	}
614 
615 	offset = (u64)track->db_s_read_offset << 8;
616 	if (offset & (surf.base_align - 1)) {
617 		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
618 			 __func__, __LINE__, offset, surf.base_align);
619 		return -EINVAL;
620 	}
621 	offset += (u64)surf.layer_size * mslice;
622 	if (offset > radeon_bo_size(track->db_s_read_bo)) {
623 		dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
624 			 "offset %llu, max layer %d, bo size %ld)\n",
625 			 __func__, __LINE__, surf.layer_size,
626 			(u64)track->db_s_read_offset << 8, mslice,
627 			radeon_bo_size(track->db_s_read_bo));
628 		dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
629 			 __func__, __LINE__, track->db_depth_size,
630 			 track->db_depth_slice, track->db_s_info, track->db_z_info);
631 		return -EINVAL;
632 	}
633 
634 	offset = (u64)track->db_s_write_offset << 8;
635 	if (offset & (surf.base_align - 1)) {
636 		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
637 			 __func__, __LINE__, offset, surf.base_align);
638 		return -EINVAL;
639 	}
640 	offset += (u64)surf.layer_size * mslice;
641 	if (offset > radeon_bo_size(track->db_s_write_bo)) {
642 		dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
643 			 "offset %llu, max layer %d, bo size %ld)\n",
644 			 __func__, __LINE__, surf.layer_size,
645 			(u64)track->db_s_write_offset << 8, mslice,
646 			radeon_bo_size(track->db_s_write_bo));
647 		return -EINVAL;
648 	}
649 
650 	/* hyperz */
651 	if (G_028040_TILE_SURFACE_ENABLE(track->db_z_info)) {
652 		r = evergreen_cs_track_validate_htile(p, surf.nbx, surf.nby);
653 		if (r) {
654 			return r;
655 		}
656 	}
657 
658 	return 0;
659 }
660 
evergreen_cs_track_validate_depth(struct radeon_cs_parser * p)661 static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
662 {
663 	struct evergreen_cs_track *track = p->track;
664 	struct eg_surface surf;
665 	unsigned pitch, slice, mslice;
666 	u64 offset;
667 	int r;
668 
669 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
670 	pitch = G_028058_PITCH_TILE_MAX(track->db_depth_size);
671 	slice = track->db_depth_slice;
672 	surf.nbx = (pitch + 1) * 8;
673 	surf.nby = ((slice + 1) * 64) / surf.nbx;
674 	surf.mode = G_028040_ARRAY_MODE(track->db_z_info);
675 	surf.format = G_028040_FORMAT(track->db_z_info);
676 	surf.tsplit = G_028040_TILE_SPLIT(track->db_z_info);
677 	surf.nbanks = G_028040_NUM_BANKS(track->db_z_info);
678 	surf.bankw = G_028040_BANK_WIDTH(track->db_z_info);
679 	surf.bankh = G_028040_BANK_HEIGHT(track->db_z_info);
680 	surf.mtilea = G_028040_MACRO_TILE_ASPECT(track->db_z_info);
681 	surf.nsamples = 1;
682 
683 	switch (surf.format) {
684 	case V_028040_Z_16:
685 		surf.format = V_028C70_COLOR_16;
686 		break;
687 	case V_028040_Z_24:
688 	case V_028040_Z_32_FLOAT:
689 		surf.format = V_028C70_COLOR_8_8_8_8;
690 		break;
691 	default:
692 		dev_warn(p->dev, "%s:%d depth invalid format %d\n",
693 			 __func__, __LINE__, surf.format);
694 		return -EINVAL;
695 	}
696 
697 	r = evergreen_surface_value_conv_check(p, &surf, "depth");
698 	if (r) {
699 		dev_warn(p->dev, "%s:%d depth invalid (0x%08x 0x%08x 0x%08x)\n",
700 			 __func__, __LINE__, track->db_depth_size,
701 			 track->db_depth_slice, track->db_z_info);
702 		return r;
703 	}
704 
705 	r = evergreen_surface_check(p, &surf, "depth");
706 	if (r) {
707 		dev_warn(p->dev, "%s:%d depth invalid (0x%08x 0x%08x 0x%08x)\n",
708 			 __func__, __LINE__, track->db_depth_size,
709 			 track->db_depth_slice, track->db_z_info);
710 		return r;
711 	}
712 
713 	offset = (u64)track->db_z_read_offset << 8;
714 	if (offset & (surf.base_align - 1)) {
715 		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
716 			 __func__, __LINE__, offset, surf.base_align);
717 		return -EINVAL;
718 	}
719 	offset += (u64)surf.layer_size * mslice;
720 	if (offset > radeon_bo_size(track->db_z_read_bo)) {
721 		dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
722 			 "offset %llu, max layer %d, bo size %ld)\n",
723 			 __func__, __LINE__, surf.layer_size,
724 			(u64)track->db_z_read_offset << 8, mslice,
725 			radeon_bo_size(track->db_z_read_bo));
726 		return -EINVAL;
727 	}
728 
729 	offset = (u64)track->db_z_write_offset << 8;
730 	if (offset & (surf.base_align - 1)) {
731 		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
732 			 __func__, __LINE__, offset, surf.base_align);
733 		return -EINVAL;
734 	}
735 	offset += (u64)surf.layer_size * mslice;
736 	if (offset > radeon_bo_size(track->db_z_write_bo)) {
737 		dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
738 			 "offset %llu, max layer %d, bo size %ld)\n",
739 			 __func__, __LINE__, surf.layer_size,
740 			(u64)track->db_z_write_offset << 8, mslice,
741 			radeon_bo_size(track->db_z_write_bo));
742 		return -EINVAL;
743 	}
744 
745 	/* hyperz */
746 	if (G_028040_TILE_SURFACE_ENABLE(track->db_z_info)) {
747 		r = evergreen_cs_track_validate_htile(p, surf.nbx, surf.nby);
748 		if (r) {
749 			return r;
750 		}
751 	}
752 
753 	return 0;
754 }
755 
evergreen_cs_track_validate_texture(struct radeon_cs_parser * p,struct radeon_bo * texture,struct radeon_bo * mipmap,unsigned idx)756 static int evergreen_cs_track_validate_texture(struct radeon_cs_parser *p,
757 					       struct radeon_bo *texture,
758 					       struct radeon_bo *mipmap,
759 					       unsigned idx)
760 {
761 	struct eg_surface surf;
762 	unsigned long toffset, moffset;
763 	unsigned dim, llevel, mslice, width, height, depth, i;
764 	u32 texdw[8];
765 	int r;
766 
767 	texdw[0] = radeon_get_ib_value(p, idx + 0);
768 	texdw[1] = radeon_get_ib_value(p, idx + 1);
769 	texdw[2] = radeon_get_ib_value(p, idx + 2);
770 	texdw[3] = radeon_get_ib_value(p, idx + 3);
771 	texdw[4] = radeon_get_ib_value(p, idx + 4);
772 	texdw[5] = radeon_get_ib_value(p, idx + 5);
773 	texdw[6] = radeon_get_ib_value(p, idx + 6);
774 	texdw[7] = radeon_get_ib_value(p, idx + 7);
775 	dim = G_030000_DIM(texdw[0]);
776 	llevel = G_030014_LAST_LEVEL(texdw[5]);
777 	mslice = G_030014_LAST_ARRAY(texdw[5]) + 1;
778 	width = G_030000_TEX_WIDTH(texdw[0]) + 1;
779 	height =  G_030004_TEX_HEIGHT(texdw[1]) + 1;
780 	depth = G_030004_TEX_DEPTH(texdw[1]) + 1;
781 	surf.format = G_03001C_DATA_FORMAT(texdw[7]);
782 	surf.nbx = (G_030000_PITCH(texdw[0]) + 1) * 8;
783 	surf.nbx = r600_fmt_get_nblocksx(surf.format, surf.nbx);
784 	surf.nby = r600_fmt_get_nblocksy(surf.format, height);
785 	surf.mode = G_030004_ARRAY_MODE(texdw[1]);
786 	surf.tsplit = G_030018_TILE_SPLIT(texdw[6]);
787 	surf.nbanks = G_03001C_NUM_BANKS(texdw[7]);
788 	surf.bankw = G_03001C_BANK_WIDTH(texdw[7]);
789 	surf.bankh = G_03001C_BANK_HEIGHT(texdw[7]);
790 	surf.mtilea = G_03001C_MACRO_TILE_ASPECT(texdw[7]);
791 	surf.nsamples = 1;
792 	toffset = texdw[2] << 8;
793 	moffset = texdw[3] << 8;
794 
795 	if (!r600_fmt_is_valid_texture(surf.format, p->family)) {
796 		dev_warn(p->dev, "%s:%d texture invalid format %d\n",
797 			 __func__, __LINE__, surf.format);
798 		return -EINVAL;
799 	}
800 	switch (dim) {
801 	case V_030000_SQ_TEX_DIM_1D:
802 	case V_030000_SQ_TEX_DIM_2D:
803 	case V_030000_SQ_TEX_DIM_CUBEMAP:
804 	case V_030000_SQ_TEX_DIM_1D_ARRAY:
805 	case V_030000_SQ_TEX_DIM_2D_ARRAY:
806 		depth = 1;
807 		break;
808 	case V_030000_SQ_TEX_DIM_2D_MSAA:
809 	case V_030000_SQ_TEX_DIM_2D_ARRAY_MSAA:
810 		surf.nsamples = 1 << llevel;
811 		llevel = 0;
812 		depth = 1;
813 		break;
814 	case V_030000_SQ_TEX_DIM_3D:
815 		break;
816 	default:
817 		dev_warn(p->dev, "%s:%d texture invalid dimension %d\n",
818 			 __func__, __LINE__, dim);
819 		return -EINVAL;
820 	}
821 
822 	r = evergreen_surface_value_conv_check(p, &surf, "texture");
823 	if (r) {
824 		return r;
825 	}
826 
827 	/* align height */
828 	evergreen_surface_check(p, &surf, NULL);
829 	surf.nby = ALIGN(surf.nby, surf.halign);
830 
831 	r = evergreen_surface_check(p, &surf, "texture");
832 	if (r) {
833 		dev_warn(p->dev, "%s:%d texture invalid 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
834 			 __func__, __LINE__, texdw[0], texdw[1], texdw[4],
835 			 texdw[5], texdw[6], texdw[7]);
836 		return r;
837 	}
838 
839 	/* check texture size */
840 	if (toffset & (surf.base_align - 1)) {
841 		dev_warn(p->dev, "%s:%d texture bo base %ld not aligned with %ld\n",
842 			 __func__, __LINE__, toffset, surf.base_align);
843 		return -EINVAL;
844 	}
845 	if (surf.nsamples <= 1 && moffset & (surf.base_align - 1)) {
846 		dev_warn(p->dev, "%s:%d mipmap bo base %ld not aligned with %ld\n",
847 			 __func__, __LINE__, moffset, surf.base_align);
848 		return -EINVAL;
849 	}
850 	if (dim == SQ_TEX_DIM_3D) {
851 		toffset += surf.layer_size * depth;
852 	} else {
853 		toffset += surf.layer_size * mslice;
854 	}
855 	if (toffset > radeon_bo_size(texture)) {
856 		dev_warn(p->dev, "%s:%d texture bo too small (layer size %d, "
857 			 "offset %ld, max layer %d, depth %d, bo size %ld) (%d %d)\n",
858 			 __func__, __LINE__, surf.layer_size,
859 			(unsigned long)texdw[2] << 8, mslice,
860 			depth, radeon_bo_size(texture),
861 			surf.nbx, surf.nby);
862 		return -EINVAL;
863 	}
864 
865 	if (!mipmap) {
866 		if (llevel) {
867 			dev_warn(p->dev, "%s:%i got NULL MIP_ADDRESS relocation\n",
868 				 __func__, __LINE__);
869 			return -EINVAL;
870 		} else {
871 			return 0; /* everything's ok */
872 		}
873 	}
874 
875 	/* check mipmap size */
876 	for (i = 1; i <= llevel; i++) {
877 		unsigned w, h, d;
878 
879 		w = r600_mip_minify(width, i);
880 		h = r600_mip_minify(height, i);
881 		d = r600_mip_minify(depth, i);
882 		surf.nbx = r600_fmt_get_nblocksx(surf.format, w);
883 		surf.nby = r600_fmt_get_nblocksy(surf.format, h);
884 
885 		switch (surf.mode) {
886 		case ARRAY_2D_TILED_THIN1:
887 			if (surf.nbx < surf.palign || surf.nby < surf.halign) {
888 				surf.mode = ARRAY_1D_TILED_THIN1;
889 			}
890 			/* recompute alignment */
891 			evergreen_surface_check(p, &surf, NULL);
892 			break;
893 		case ARRAY_LINEAR_GENERAL:
894 		case ARRAY_LINEAR_ALIGNED:
895 		case ARRAY_1D_TILED_THIN1:
896 			break;
897 		default:
898 			dev_warn(p->dev, "%s:%d invalid array mode %d\n",
899 				 __func__, __LINE__, surf.mode);
900 			return -EINVAL;
901 		}
902 		surf.nbx = ALIGN(surf.nbx, surf.palign);
903 		surf.nby = ALIGN(surf.nby, surf.halign);
904 
905 		r = evergreen_surface_check(p, &surf, "mipmap");
906 		if (r) {
907 			return r;
908 		}
909 
910 		if (dim == SQ_TEX_DIM_3D) {
911 			moffset += surf.layer_size * d;
912 		} else {
913 			moffset += surf.layer_size * mslice;
914 		}
915 		if (moffset > radeon_bo_size(mipmap)) {
916 			dev_warn(p->dev, "%s:%d mipmap [%d] bo too small (layer size %d, "
917 					"offset %ld, coffset %ld, max layer %d, depth %d, "
918 					"bo size %ld) level0 (%d %d %d)\n",
919 					__func__, __LINE__, i, surf.layer_size,
920 					(unsigned long)texdw[3] << 8, moffset, mslice,
921 					d, radeon_bo_size(mipmap),
922 					width, height, depth);
923 			dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
924 				 __func__, __LINE__, surf.nbx, surf.nby,
925 				surf.mode, surf.bpe, surf.nsamples,
926 				surf.bankw, surf.bankh,
927 				surf.tsplit, surf.mtilea);
928 			return -EINVAL;
929 		}
930 	}
931 
932 	return 0;
933 }
934 
evergreen_cs_track_check(struct radeon_cs_parser * p)935 static int evergreen_cs_track_check(struct radeon_cs_parser *p)
936 {
937 	struct evergreen_cs_track *track = p->track;
938 	unsigned tmp, i;
939 	int r;
940 	unsigned buffer_mask = 0;
941 
942 	/* check streamout */
943 	if (track->streamout_dirty && track->vgt_strmout_config) {
944 		for (i = 0; i < 4; i++) {
945 			if (track->vgt_strmout_config & (1 << i)) {
946 				buffer_mask |= (track->vgt_strmout_buffer_config >> (i * 4)) & 0xf;
947 			}
948 		}
949 
950 		for (i = 0; i < 4; i++) {
951 			if (buffer_mask & (1 << i)) {
952 				if (track->vgt_strmout_bo[i]) {
953 					u64 offset = (u64)track->vgt_strmout_bo_offset[i] +
954 							(u64)track->vgt_strmout_size[i];
955 					if (offset > radeon_bo_size(track->vgt_strmout_bo[i])) {
956 						dev_warn_once(p->dev, "streamout %d bo too small: 0x%llx, 0x%lx\n",
957 							      i, offset,
958 							      radeon_bo_size(track->vgt_strmout_bo[i]));
959 						return -EINVAL;
960 					}
961 				} else {
962 					dev_warn_once(p->dev, "No buffer for streamout %d\n", i);
963 					return -EINVAL;
964 				}
965 			}
966 		}
967 		track->streamout_dirty = false;
968 	}
969 
970 	if (track->sx_misc_kill_all_prims)
971 		return 0;
972 
973 	/* check that we have a cb for each enabled target
974 	 */
975 	if (track->cb_dirty) {
976 		tmp = track->cb_target_mask;
977 		for (i = 0; i < 8; i++) {
978 			u32 format = G_028C70_FORMAT(track->cb_color_info[i]);
979 
980 			if (format != V_028C70_COLOR_INVALID &&
981 			    (tmp >> (i * 4)) & 0xF) {
982 				/* at least one component is enabled */
983 				if (track->cb_color_bo[i] == NULL) {
984 					dev_warn_once(p->dev, "%s:%d mask 0x%08X | 0x%08X no cb for %d\n",
985 						      __func__, __LINE__, track->cb_target_mask, track->cb_shader_mask, i);
986 					return -EINVAL;
987 				}
988 				/* check cb */
989 				r = evergreen_cs_track_validate_cb(p, i);
990 				if (r) {
991 					return r;
992 				}
993 			}
994 		}
995 		track->cb_dirty = false;
996 	}
997 
998 	if (track->db_dirty) {
999 		/* Check stencil buffer */
1000 		if (G_028044_FORMAT(track->db_s_info) != V_028044_STENCIL_INVALID &&
1001 		    G_028800_STENCIL_ENABLE(track->db_depth_control)) {
1002 			r = evergreen_cs_track_validate_stencil(p);
1003 			if (r)
1004 				return r;
1005 		}
1006 		/* Check depth buffer */
1007 		if (G_028040_FORMAT(track->db_z_info) != V_028040_Z_INVALID &&
1008 		    G_028800_Z_ENABLE(track->db_depth_control)) {
1009 			r = evergreen_cs_track_validate_depth(p);
1010 			if (r)
1011 				return r;
1012 		}
1013 		track->db_dirty = false;
1014 	}
1015 
1016 	return 0;
1017 }
1018 
1019 /**
1020  * evergreen_cs_packet_parse_vline() - parse userspace VLINE packet
1021  * @p:		parser structure holding parsing context.
1022  *
1023  * This is an Evergreen(+)-specific function for parsing VLINE packets.
1024  * Real work is done by r600_cs_common_vline_parse function.
1025  * Here we just set up ASIC-specific register table and call
1026  * the common implementation function.
1027  */
evergreen_cs_packet_parse_vline(struct radeon_cs_parser * p)1028 static int evergreen_cs_packet_parse_vline(struct radeon_cs_parser *p)
1029 {
1030 
1031 	static uint32_t vline_start_end[6] = {
1032 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC0_REGISTER_OFFSET,
1033 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC1_REGISTER_OFFSET,
1034 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC2_REGISTER_OFFSET,
1035 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC3_REGISTER_OFFSET,
1036 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC4_REGISTER_OFFSET,
1037 		EVERGREEN_VLINE_START_END + EVERGREEN_CRTC5_REGISTER_OFFSET
1038 	};
1039 	static uint32_t vline_status[6] = {
1040 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET,
1041 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET,
1042 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET,
1043 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC3_REGISTER_OFFSET,
1044 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET,
1045 		EVERGREEN_VLINE_STATUS + EVERGREEN_CRTC5_REGISTER_OFFSET
1046 	};
1047 
1048 	return r600_cs_common_vline_parse(p, vline_start_end, vline_status);
1049 }
1050 
evergreen_packet0_check(struct radeon_cs_parser * p,struct radeon_cs_packet * pkt,unsigned idx,unsigned reg)1051 static int evergreen_packet0_check(struct radeon_cs_parser *p,
1052 				   struct radeon_cs_packet *pkt,
1053 				   unsigned idx, unsigned reg)
1054 {
1055 	int r;
1056 
1057 	switch (reg) {
1058 	case EVERGREEN_VLINE_START_END:
1059 		r = evergreen_cs_packet_parse_vline(p);
1060 		if (r) {
1061 			dev_warn_once(p->dev, "No reloc for ib[%d]=0x%04X\n",
1062 				      idx, reg);
1063 			return r;
1064 		}
1065 		break;
1066 	default:
1067 		pr_err("Forbidden register 0x%04X in cs at %d\n", reg, idx);
1068 		return -EINVAL;
1069 	}
1070 	return 0;
1071 }
1072 
evergreen_cs_parse_packet0(struct radeon_cs_parser * p,struct radeon_cs_packet * pkt)1073 static int evergreen_cs_parse_packet0(struct radeon_cs_parser *p,
1074 				      struct radeon_cs_packet *pkt)
1075 {
1076 	unsigned reg, i;
1077 	unsigned idx;
1078 	int r;
1079 
1080 	idx = pkt->idx + 1;
1081 	reg = pkt->reg;
1082 	for (i = 0; i <= pkt->count; i++, idx++, reg += 4) {
1083 		r = evergreen_packet0_check(p, pkt, idx, reg);
1084 		if (r) {
1085 			return r;
1086 		}
1087 	}
1088 	return 0;
1089 }
1090 
1091 /**
1092  * evergreen_cs_handle_reg() - process registers that need special handling.
1093  * @p: parser structure holding parsing context
1094  * @reg: register we are testing
1095  * @idx: index into the cs buffer
1096  */
evergreen_cs_handle_reg(struct radeon_cs_parser * p,u32 reg,u32 idx)1097 static int evergreen_cs_handle_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
1098 {
1099 	struct evergreen_cs_track *track = (struct evergreen_cs_track *)p->track;
1100 	struct radeon_bo_list *reloc;
1101 	u32 tmp, *ib;
1102 	int r;
1103 
1104 	ib = p->ib.ptr;
1105 	switch (reg) {
1106 	/* force following reg to 0 in an attempt to disable out buffer
1107 	 * which will need us to better understand how it works to perform
1108 	 * security check on it (Jerome)
1109 	 */
1110 	case SQ_ESGS_RING_SIZE:
1111 	case SQ_GSVS_RING_SIZE:
1112 	case SQ_ESTMP_RING_SIZE:
1113 	case SQ_GSTMP_RING_SIZE:
1114 	case SQ_HSTMP_RING_SIZE:
1115 	case SQ_LSTMP_RING_SIZE:
1116 	case SQ_PSTMP_RING_SIZE:
1117 	case SQ_VSTMP_RING_SIZE:
1118 	case SQ_ESGS_RING_ITEMSIZE:
1119 	case SQ_ESTMP_RING_ITEMSIZE:
1120 	case SQ_GSTMP_RING_ITEMSIZE:
1121 	case SQ_GSVS_RING_ITEMSIZE:
1122 	case SQ_GS_VERT_ITEMSIZE:
1123 	case SQ_GS_VERT_ITEMSIZE_1:
1124 	case SQ_GS_VERT_ITEMSIZE_2:
1125 	case SQ_GS_VERT_ITEMSIZE_3:
1126 	case SQ_GSVS_RING_OFFSET_1:
1127 	case SQ_GSVS_RING_OFFSET_2:
1128 	case SQ_GSVS_RING_OFFSET_3:
1129 	case SQ_HSTMP_RING_ITEMSIZE:
1130 	case SQ_LSTMP_RING_ITEMSIZE:
1131 	case SQ_PSTMP_RING_ITEMSIZE:
1132 	case SQ_VSTMP_RING_ITEMSIZE:
1133 	case VGT_TF_RING_SIZE:
1134 		/* get value to populate the IB don't remove */
1135 		/*tmp =radeon_get_ib_value(p, idx);
1136 		  ib[idx] = 0;*/
1137 		break;
1138 	case SQ_ESGS_RING_BASE:
1139 	case SQ_GSVS_RING_BASE:
1140 	case SQ_ESTMP_RING_BASE:
1141 	case SQ_GSTMP_RING_BASE:
1142 	case SQ_HSTMP_RING_BASE:
1143 	case SQ_LSTMP_RING_BASE:
1144 	case SQ_PSTMP_RING_BASE:
1145 	case SQ_VSTMP_RING_BASE:
1146 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1147 		if (r) {
1148 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1149 				      "0x%04X\n", reg);
1150 			return -EINVAL;
1151 		}
1152 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1153 		break;
1154 	case DB_DEPTH_CONTROL:
1155 		track->db_depth_control = radeon_get_ib_value(p, idx);
1156 		track->db_dirty = true;
1157 		break;
1158 	case CAYMAN_DB_EQAA:
1159 		if (p->rdev->family < CHIP_CAYMAN) {
1160 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1161 				      "0x%04X\n", reg);
1162 			return -EINVAL;
1163 		}
1164 		break;
1165 	case CAYMAN_DB_DEPTH_INFO:
1166 		if (p->rdev->family < CHIP_CAYMAN) {
1167 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1168 				      "0x%04X\n", reg);
1169 			return -EINVAL;
1170 		}
1171 		break;
1172 	case DB_Z_INFO:
1173 		track->db_z_info = radeon_get_ib_value(p, idx);
1174 		if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1175 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1176 			if (r) {
1177 				dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1178 					      "0x%04X\n", reg);
1179 				return -EINVAL;
1180 			}
1181 			ib[idx] &= ~Z_ARRAY_MODE(0xf);
1182 			track->db_z_info &= ~Z_ARRAY_MODE(0xf);
1183 			ib[idx] |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1184 			track->db_z_info |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1185 			if (reloc->tiling_flags & RADEON_TILING_MACRO) {
1186 				unsigned bankw, bankh, mtaspect, tile_split;
1187 
1188 				evergreen_tiling_fields(reloc->tiling_flags,
1189 							&bankw, &bankh, &mtaspect,
1190 							&tile_split);
1191 				ib[idx] |= DB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1192 				ib[idx] |= DB_TILE_SPLIT(tile_split) |
1193 						DB_BANK_WIDTH(bankw) |
1194 						DB_BANK_HEIGHT(bankh) |
1195 						DB_MACRO_TILE_ASPECT(mtaspect);
1196 			}
1197 		}
1198 		track->db_dirty = true;
1199 		break;
1200 	case DB_STENCIL_INFO:
1201 		track->db_s_info = radeon_get_ib_value(p, idx);
1202 		track->db_dirty = true;
1203 		break;
1204 	case DB_DEPTH_VIEW:
1205 		track->db_depth_view = radeon_get_ib_value(p, idx);
1206 		track->db_dirty = true;
1207 		break;
1208 	case DB_DEPTH_SIZE:
1209 		track->db_depth_size = radeon_get_ib_value(p, idx);
1210 		track->db_dirty = true;
1211 		break;
1212 	case R_02805C_DB_DEPTH_SLICE:
1213 		track->db_depth_slice = radeon_get_ib_value(p, idx);
1214 		track->db_dirty = true;
1215 		break;
1216 	case DB_Z_READ_BASE:
1217 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1218 		if (r) {
1219 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1220 				      "0x%04X\n", reg);
1221 			return -EINVAL;
1222 		}
1223 		track->db_z_read_offset = radeon_get_ib_value(p, idx);
1224 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1225 		track->db_z_read_bo = reloc->robj;
1226 		track->db_dirty = true;
1227 		break;
1228 	case DB_Z_WRITE_BASE:
1229 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1230 		if (r) {
1231 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1232 				      "0x%04X\n", reg);
1233 			return -EINVAL;
1234 		}
1235 		track->db_z_write_offset = radeon_get_ib_value(p, idx);
1236 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1237 		track->db_z_write_bo = reloc->robj;
1238 		track->db_dirty = true;
1239 		break;
1240 	case DB_STENCIL_READ_BASE:
1241 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1242 		if (r) {
1243 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1244 				      "0x%04X\n", reg);
1245 			return -EINVAL;
1246 		}
1247 		track->db_s_read_offset = radeon_get_ib_value(p, idx);
1248 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1249 		track->db_s_read_bo = reloc->robj;
1250 		track->db_dirty = true;
1251 		break;
1252 	case DB_STENCIL_WRITE_BASE:
1253 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1254 		if (r) {
1255 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1256 				      "0x%04X\n", reg);
1257 			return -EINVAL;
1258 		}
1259 		track->db_s_write_offset = radeon_get_ib_value(p, idx);
1260 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1261 		track->db_s_write_bo = reloc->robj;
1262 		track->db_dirty = true;
1263 		break;
1264 	case VGT_STRMOUT_CONFIG:
1265 		track->vgt_strmout_config = radeon_get_ib_value(p, idx);
1266 		track->streamout_dirty = true;
1267 		break;
1268 	case VGT_STRMOUT_BUFFER_CONFIG:
1269 		track->vgt_strmout_buffer_config = radeon_get_ib_value(p, idx);
1270 		track->streamout_dirty = true;
1271 		break;
1272 	case VGT_STRMOUT_BUFFER_BASE_0:
1273 	case VGT_STRMOUT_BUFFER_BASE_1:
1274 	case VGT_STRMOUT_BUFFER_BASE_2:
1275 	case VGT_STRMOUT_BUFFER_BASE_3:
1276 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1277 		if (r) {
1278 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1279 				      "0x%04X\n", reg);
1280 			return -EINVAL;
1281 		}
1282 		tmp = (reg - VGT_STRMOUT_BUFFER_BASE_0) / 16;
1283 		track->vgt_strmout_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
1284 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1285 		track->vgt_strmout_bo[tmp] = reloc->robj;
1286 		track->streamout_dirty = true;
1287 		break;
1288 	case VGT_STRMOUT_BUFFER_SIZE_0:
1289 	case VGT_STRMOUT_BUFFER_SIZE_1:
1290 	case VGT_STRMOUT_BUFFER_SIZE_2:
1291 	case VGT_STRMOUT_BUFFER_SIZE_3:
1292 		tmp = (reg - VGT_STRMOUT_BUFFER_SIZE_0) / 16;
1293 		/* size in register is DWs, convert to bytes */
1294 		track->vgt_strmout_size[tmp] = radeon_get_ib_value(p, idx) * 4;
1295 		track->streamout_dirty = true;
1296 		break;
1297 	case CP_COHER_BASE:
1298 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1299 		if (r) {
1300 			dev_warn_once(p->dev, "missing reloc for CP_COHER_BASE "
1301 				      "0x%04X\n", reg);
1302 			return -EINVAL;
1303 		}
1304 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1305 		break;
1306 	case CB_TARGET_MASK:
1307 		track->cb_target_mask = radeon_get_ib_value(p, idx);
1308 		track->cb_dirty = true;
1309 		break;
1310 	case CB_SHADER_MASK:
1311 		track->cb_shader_mask = radeon_get_ib_value(p, idx);
1312 		track->cb_dirty = true;
1313 		break;
1314 	case PA_SC_AA_CONFIG:
1315 		if (p->rdev->family >= CHIP_CAYMAN) {
1316 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1317 				      "0x%04X\n", reg);
1318 			return -EINVAL;
1319 		}
1320 		tmp = radeon_get_ib_value(p, idx) & MSAA_NUM_SAMPLES_MASK;
1321 		track->nsamples = 1 << tmp;
1322 		break;
1323 	case CAYMAN_PA_SC_AA_CONFIG:
1324 		if (p->rdev->family < CHIP_CAYMAN) {
1325 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1326 				      "0x%04X\n", reg);
1327 			return -EINVAL;
1328 		}
1329 		tmp = radeon_get_ib_value(p, idx) & CAYMAN_MSAA_NUM_SAMPLES_MASK;
1330 		track->nsamples = 1 << tmp;
1331 		break;
1332 	case CB_COLOR0_VIEW:
1333 	case CB_COLOR1_VIEW:
1334 	case CB_COLOR2_VIEW:
1335 	case CB_COLOR3_VIEW:
1336 	case CB_COLOR4_VIEW:
1337 	case CB_COLOR5_VIEW:
1338 	case CB_COLOR6_VIEW:
1339 	case CB_COLOR7_VIEW:
1340 		tmp = (reg - CB_COLOR0_VIEW) / 0x3c;
1341 		track->cb_color_view[tmp] = radeon_get_ib_value(p, idx);
1342 		track->cb_dirty = true;
1343 		break;
1344 	case CB_COLOR8_VIEW:
1345 	case CB_COLOR9_VIEW:
1346 	case CB_COLOR10_VIEW:
1347 	case CB_COLOR11_VIEW:
1348 		tmp = ((reg - CB_COLOR8_VIEW) / 0x1c) + 8;
1349 		track->cb_color_view[tmp] = radeon_get_ib_value(p, idx);
1350 		track->cb_dirty = true;
1351 		break;
1352 	case CB_COLOR0_INFO:
1353 	case CB_COLOR1_INFO:
1354 	case CB_COLOR2_INFO:
1355 	case CB_COLOR3_INFO:
1356 	case CB_COLOR4_INFO:
1357 	case CB_COLOR5_INFO:
1358 	case CB_COLOR6_INFO:
1359 	case CB_COLOR7_INFO:
1360 		tmp = (reg - CB_COLOR0_INFO) / 0x3c;
1361 		track->cb_color_info[tmp] = radeon_get_ib_value(p, idx);
1362 		if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1363 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1364 			if (r) {
1365 				dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1366 					      "0x%04X\n", reg);
1367 				return -EINVAL;
1368 			}
1369 			ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1370 			track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1371 		}
1372 		track->cb_dirty = true;
1373 		break;
1374 	case CB_COLOR8_INFO:
1375 	case CB_COLOR9_INFO:
1376 	case CB_COLOR10_INFO:
1377 	case CB_COLOR11_INFO:
1378 		tmp = ((reg - CB_COLOR8_INFO) / 0x1c) + 8;
1379 		track->cb_color_info[tmp] = radeon_get_ib_value(p, idx);
1380 		if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1381 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1382 			if (r) {
1383 				dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1384 					      "0x%04X\n", reg);
1385 				return -EINVAL;
1386 			}
1387 			ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1388 			track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
1389 		}
1390 		track->cb_dirty = true;
1391 		break;
1392 	case CB_COLOR0_PITCH:
1393 	case CB_COLOR1_PITCH:
1394 	case CB_COLOR2_PITCH:
1395 	case CB_COLOR3_PITCH:
1396 	case CB_COLOR4_PITCH:
1397 	case CB_COLOR5_PITCH:
1398 	case CB_COLOR6_PITCH:
1399 	case CB_COLOR7_PITCH:
1400 		tmp = (reg - CB_COLOR0_PITCH) / 0x3c;
1401 		track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx);
1402 		track->cb_dirty = true;
1403 		break;
1404 	case CB_COLOR8_PITCH:
1405 	case CB_COLOR9_PITCH:
1406 	case CB_COLOR10_PITCH:
1407 	case CB_COLOR11_PITCH:
1408 		tmp = ((reg - CB_COLOR8_PITCH) / 0x1c) + 8;
1409 		track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx);
1410 		track->cb_dirty = true;
1411 		break;
1412 	case CB_COLOR0_SLICE:
1413 	case CB_COLOR1_SLICE:
1414 	case CB_COLOR2_SLICE:
1415 	case CB_COLOR3_SLICE:
1416 	case CB_COLOR4_SLICE:
1417 	case CB_COLOR5_SLICE:
1418 	case CB_COLOR6_SLICE:
1419 	case CB_COLOR7_SLICE:
1420 		tmp = (reg - CB_COLOR0_SLICE) / 0x3c;
1421 		track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
1422 		track->cb_color_slice_idx[tmp] = idx;
1423 		track->cb_dirty = true;
1424 		break;
1425 	case CB_COLOR8_SLICE:
1426 	case CB_COLOR9_SLICE:
1427 	case CB_COLOR10_SLICE:
1428 	case CB_COLOR11_SLICE:
1429 		tmp = ((reg - CB_COLOR8_SLICE) / 0x1c) + 8;
1430 		track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
1431 		track->cb_color_slice_idx[tmp] = idx;
1432 		track->cb_dirty = true;
1433 		break;
1434 	case CB_COLOR0_ATTRIB:
1435 	case CB_COLOR1_ATTRIB:
1436 	case CB_COLOR2_ATTRIB:
1437 	case CB_COLOR3_ATTRIB:
1438 	case CB_COLOR4_ATTRIB:
1439 	case CB_COLOR5_ATTRIB:
1440 	case CB_COLOR6_ATTRIB:
1441 	case CB_COLOR7_ATTRIB:
1442 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1443 		if (r) {
1444 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1445 				      "0x%04X\n", reg);
1446 			return -EINVAL;
1447 		}
1448 		if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1449 			if (reloc->tiling_flags & RADEON_TILING_MACRO) {
1450 				unsigned bankw, bankh, mtaspect, tile_split;
1451 
1452 				evergreen_tiling_fields(reloc->tiling_flags,
1453 							&bankw, &bankh, &mtaspect,
1454 							&tile_split);
1455 				ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1456 				ib[idx] |= CB_TILE_SPLIT(tile_split) |
1457 					   CB_BANK_WIDTH(bankw) |
1458 					   CB_BANK_HEIGHT(bankh) |
1459 					   CB_MACRO_TILE_ASPECT(mtaspect);
1460 			}
1461 		}
1462 		tmp = ((reg - CB_COLOR0_ATTRIB) / 0x3c);
1463 		track->cb_color_attrib[tmp] = ib[idx];
1464 		track->cb_dirty = true;
1465 		break;
1466 	case CB_COLOR8_ATTRIB:
1467 	case CB_COLOR9_ATTRIB:
1468 	case CB_COLOR10_ATTRIB:
1469 	case CB_COLOR11_ATTRIB:
1470 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1471 		if (r) {
1472 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1473 				      "0x%04X\n", reg);
1474 			return -EINVAL;
1475 		}
1476 		if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1477 			if (reloc->tiling_flags & RADEON_TILING_MACRO) {
1478 				unsigned bankw, bankh, mtaspect, tile_split;
1479 
1480 				evergreen_tiling_fields(reloc->tiling_flags,
1481 							&bankw, &bankh, &mtaspect,
1482 							&tile_split);
1483 				ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1484 				ib[idx] |= CB_TILE_SPLIT(tile_split) |
1485 					   CB_BANK_WIDTH(bankw) |
1486 					   CB_BANK_HEIGHT(bankh) |
1487 					   CB_MACRO_TILE_ASPECT(mtaspect);
1488 			}
1489 		}
1490 		tmp = ((reg - CB_COLOR8_ATTRIB) / 0x1c) + 8;
1491 		track->cb_color_attrib[tmp] = ib[idx];
1492 		track->cb_dirty = true;
1493 		break;
1494 	case CB_COLOR0_FMASK:
1495 	case CB_COLOR1_FMASK:
1496 	case CB_COLOR2_FMASK:
1497 	case CB_COLOR3_FMASK:
1498 	case CB_COLOR4_FMASK:
1499 	case CB_COLOR5_FMASK:
1500 	case CB_COLOR6_FMASK:
1501 	case CB_COLOR7_FMASK:
1502 		tmp = (reg - CB_COLOR0_FMASK) / 0x3c;
1503 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1504 		if (r) {
1505 			dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
1506 			return -EINVAL;
1507 		}
1508 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1509 		track->cb_color_fmask_bo[tmp] = reloc->robj;
1510 		break;
1511 	case CB_COLOR0_CMASK:
1512 	case CB_COLOR1_CMASK:
1513 	case CB_COLOR2_CMASK:
1514 	case CB_COLOR3_CMASK:
1515 	case CB_COLOR4_CMASK:
1516 	case CB_COLOR5_CMASK:
1517 	case CB_COLOR6_CMASK:
1518 	case CB_COLOR7_CMASK:
1519 		tmp = (reg - CB_COLOR0_CMASK) / 0x3c;
1520 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1521 		if (r) {
1522 			dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
1523 			return -EINVAL;
1524 		}
1525 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1526 		track->cb_color_cmask_bo[tmp] = reloc->robj;
1527 		break;
1528 	case CB_COLOR0_FMASK_SLICE:
1529 	case CB_COLOR1_FMASK_SLICE:
1530 	case CB_COLOR2_FMASK_SLICE:
1531 	case CB_COLOR3_FMASK_SLICE:
1532 	case CB_COLOR4_FMASK_SLICE:
1533 	case CB_COLOR5_FMASK_SLICE:
1534 	case CB_COLOR6_FMASK_SLICE:
1535 	case CB_COLOR7_FMASK_SLICE:
1536 		tmp = (reg - CB_COLOR0_FMASK_SLICE) / 0x3c;
1537 		track->cb_color_fmask_slice[tmp] = radeon_get_ib_value(p, idx);
1538 		break;
1539 	case CB_COLOR0_CMASK_SLICE:
1540 	case CB_COLOR1_CMASK_SLICE:
1541 	case CB_COLOR2_CMASK_SLICE:
1542 	case CB_COLOR3_CMASK_SLICE:
1543 	case CB_COLOR4_CMASK_SLICE:
1544 	case CB_COLOR5_CMASK_SLICE:
1545 	case CB_COLOR6_CMASK_SLICE:
1546 	case CB_COLOR7_CMASK_SLICE:
1547 		tmp = (reg - CB_COLOR0_CMASK_SLICE) / 0x3c;
1548 		track->cb_color_cmask_slice[tmp] = radeon_get_ib_value(p, idx);
1549 		break;
1550 	case CB_COLOR0_BASE:
1551 	case CB_COLOR1_BASE:
1552 	case CB_COLOR2_BASE:
1553 	case CB_COLOR3_BASE:
1554 	case CB_COLOR4_BASE:
1555 	case CB_COLOR5_BASE:
1556 	case CB_COLOR6_BASE:
1557 	case CB_COLOR7_BASE:
1558 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1559 		if (r) {
1560 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1561 				      "0x%04X\n", reg);
1562 			return -EINVAL;
1563 		}
1564 		tmp = (reg - CB_COLOR0_BASE) / 0x3c;
1565 		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
1566 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1567 		track->cb_color_bo[tmp] = reloc->robj;
1568 		track->cb_dirty = true;
1569 		break;
1570 	case CB_COLOR8_BASE:
1571 	case CB_COLOR9_BASE:
1572 	case CB_COLOR10_BASE:
1573 	case CB_COLOR11_BASE:
1574 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1575 		if (r) {
1576 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1577 				      "0x%04X\n", reg);
1578 			return -EINVAL;
1579 		}
1580 		tmp = ((reg - CB_COLOR8_BASE) / 0x1c) + 8;
1581 		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
1582 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1583 		track->cb_color_bo[tmp] = reloc->robj;
1584 		track->cb_dirty = true;
1585 		break;
1586 	case DB_HTILE_DATA_BASE:
1587 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1588 		if (r) {
1589 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1590 				      "0x%04X\n", reg);
1591 			return -EINVAL;
1592 		}
1593 		track->htile_offset = radeon_get_ib_value(p, idx);
1594 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1595 		track->htile_bo = reloc->robj;
1596 		track->db_dirty = true;
1597 		break;
1598 	case DB_HTILE_SURFACE:
1599 		/* 8x8 only */
1600 		track->htile_surface = radeon_get_ib_value(p, idx);
1601 		/* force 8x8 htile width and height */
1602 		ib[idx] |= 3;
1603 		track->db_dirty = true;
1604 		break;
1605 	case CB_IMMED0_BASE:
1606 	case CB_IMMED1_BASE:
1607 	case CB_IMMED2_BASE:
1608 	case CB_IMMED3_BASE:
1609 	case CB_IMMED4_BASE:
1610 	case CB_IMMED5_BASE:
1611 	case CB_IMMED6_BASE:
1612 	case CB_IMMED7_BASE:
1613 	case CB_IMMED8_BASE:
1614 	case CB_IMMED9_BASE:
1615 	case CB_IMMED10_BASE:
1616 	case CB_IMMED11_BASE:
1617 	case SQ_PGM_START_FS:
1618 	case SQ_PGM_START_ES:
1619 	case SQ_PGM_START_VS:
1620 	case SQ_PGM_START_GS:
1621 	case SQ_PGM_START_PS:
1622 	case SQ_PGM_START_HS:
1623 	case SQ_PGM_START_LS:
1624 	case SQ_CONST_MEM_BASE:
1625 	case SQ_ALU_CONST_CACHE_GS_0:
1626 	case SQ_ALU_CONST_CACHE_GS_1:
1627 	case SQ_ALU_CONST_CACHE_GS_2:
1628 	case SQ_ALU_CONST_CACHE_GS_3:
1629 	case SQ_ALU_CONST_CACHE_GS_4:
1630 	case SQ_ALU_CONST_CACHE_GS_5:
1631 	case SQ_ALU_CONST_CACHE_GS_6:
1632 	case SQ_ALU_CONST_CACHE_GS_7:
1633 	case SQ_ALU_CONST_CACHE_GS_8:
1634 	case SQ_ALU_CONST_CACHE_GS_9:
1635 	case SQ_ALU_CONST_CACHE_GS_10:
1636 	case SQ_ALU_CONST_CACHE_GS_11:
1637 	case SQ_ALU_CONST_CACHE_GS_12:
1638 	case SQ_ALU_CONST_CACHE_GS_13:
1639 	case SQ_ALU_CONST_CACHE_GS_14:
1640 	case SQ_ALU_CONST_CACHE_GS_15:
1641 	case SQ_ALU_CONST_CACHE_PS_0:
1642 	case SQ_ALU_CONST_CACHE_PS_1:
1643 	case SQ_ALU_CONST_CACHE_PS_2:
1644 	case SQ_ALU_CONST_CACHE_PS_3:
1645 	case SQ_ALU_CONST_CACHE_PS_4:
1646 	case SQ_ALU_CONST_CACHE_PS_5:
1647 	case SQ_ALU_CONST_CACHE_PS_6:
1648 	case SQ_ALU_CONST_CACHE_PS_7:
1649 	case SQ_ALU_CONST_CACHE_PS_8:
1650 	case SQ_ALU_CONST_CACHE_PS_9:
1651 	case SQ_ALU_CONST_CACHE_PS_10:
1652 	case SQ_ALU_CONST_CACHE_PS_11:
1653 	case SQ_ALU_CONST_CACHE_PS_12:
1654 	case SQ_ALU_CONST_CACHE_PS_13:
1655 	case SQ_ALU_CONST_CACHE_PS_14:
1656 	case SQ_ALU_CONST_CACHE_PS_15:
1657 	case SQ_ALU_CONST_CACHE_VS_0:
1658 	case SQ_ALU_CONST_CACHE_VS_1:
1659 	case SQ_ALU_CONST_CACHE_VS_2:
1660 	case SQ_ALU_CONST_CACHE_VS_3:
1661 	case SQ_ALU_CONST_CACHE_VS_4:
1662 	case SQ_ALU_CONST_CACHE_VS_5:
1663 	case SQ_ALU_CONST_CACHE_VS_6:
1664 	case SQ_ALU_CONST_CACHE_VS_7:
1665 	case SQ_ALU_CONST_CACHE_VS_8:
1666 	case SQ_ALU_CONST_CACHE_VS_9:
1667 	case SQ_ALU_CONST_CACHE_VS_10:
1668 	case SQ_ALU_CONST_CACHE_VS_11:
1669 	case SQ_ALU_CONST_CACHE_VS_12:
1670 	case SQ_ALU_CONST_CACHE_VS_13:
1671 	case SQ_ALU_CONST_CACHE_VS_14:
1672 	case SQ_ALU_CONST_CACHE_VS_15:
1673 	case SQ_ALU_CONST_CACHE_HS_0:
1674 	case SQ_ALU_CONST_CACHE_HS_1:
1675 	case SQ_ALU_CONST_CACHE_HS_2:
1676 	case SQ_ALU_CONST_CACHE_HS_3:
1677 	case SQ_ALU_CONST_CACHE_HS_4:
1678 	case SQ_ALU_CONST_CACHE_HS_5:
1679 	case SQ_ALU_CONST_CACHE_HS_6:
1680 	case SQ_ALU_CONST_CACHE_HS_7:
1681 	case SQ_ALU_CONST_CACHE_HS_8:
1682 	case SQ_ALU_CONST_CACHE_HS_9:
1683 	case SQ_ALU_CONST_CACHE_HS_10:
1684 	case SQ_ALU_CONST_CACHE_HS_11:
1685 	case SQ_ALU_CONST_CACHE_HS_12:
1686 	case SQ_ALU_CONST_CACHE_HS_13:
1687 	case SQ_ALU_CONST_CACHE_HS_14:
1688 	case SQ_ALU_CONST_CACHE_HS_15:
1689 	case SQ_ALU_CONST_CACHE_LS_0:
1690 	case SQ_ALU_CONST_CACHE_LS_1:
1691 	case SQ_ALU_CONST_CACHE_LS_2:
1692 	case SQ_ALU_CONST_CACHE_LS_3:
1693 	case SQ_ALU_CONST_CACHE_LS_4:
1694 	case SQ_ALU_CONST_CACHE_LS_5:
1695 	case SQ_ALU_CONST_CACHE_LS_6:
1696 	case SQ_ALU_CONST_CACHE_LS_7:
1697 	case SQ_ALU_CONST_CACHE_LS_8:
1698 	case SQ_ALU_CONST_CACHE_LS_9:
1699 	case SQ_ALU_CONST_CACHE_LS_10:
1700 	case SQ_ALU_CONST_CACHE_LS_11:
1701 	case SQ_ALU_CONST_CACHE_LS_12:
1702 	case SQ_ALU_CONST_CACHE_LS_13:
1703 	case SQ_ALU_CONST_CACHE_LS_14:
1704 	case SQ_ALU_CONST_CACHE_LS_15:
1705 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1706 		if (r) {
1707 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1708 				      "0x%04X\n", reg);
1709 			return -EINVAL;
1710 		}
1711 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1712 		break;
1713 	case SX_MEMORY_EXPORT_BASE:
1714 		if (p->rdev->family >= CHIP_CAYMAN) {
1715 			dev_warn_once(p->dev, "bad SET_CONFIG_REG "
1716 				      "0x%04X\n", reg);
1717 			return -EINVAL;
1718 		}
1719 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1720 		if (r) {
1721 			dev_warn_once(p->dev, "bad SET_CONFIG_REG "
1722 				      "0x%04X\n", reg);
1723 			return -EINVAL;
1724 		}
1725 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1726 		break;
1727 	case CAYMAN_SX_SCATTER_EXPORT_BASE:
1728 		if (p->rdev->family < CHIP_CAYMAN) {
1729 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1730 				      "0x%04X\n", reg);
1731 			return -EINVAL;
1732 		}
1733 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1734 		if (r) {
1735 			dev_warn_once(p->dev, "bad SET_CONTEXT_REG "
1736 				      "0x%04X\n", reg);
1737 			return -EINVAL;
1738 		}
1739 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
1740 		break;
1741 	case SX_MISC:
1742 		track->sx_misc_kill_all_prims = (radeon_get_ib_value(p, idx) & 0x1) != 0;
1743 		break;
1744 	default:
1745 		dev_warn_once(p->dev, "forbidden register 0x%08x at %d\n", reg, idx);
1746 		return -EINVAL;
1747 	}
1748 	return 0;
1749 }
1750 
1751 /**
1752  * evergreen_is_safe_reg() - check if register is authorized or not
1753  * @p: parser structure holding parsing context
1754  * @reg: register we are testing
1755  *
1756  * This function will test against reg_safe_bm and return true
1757  * if register is safe or false otherwise.
1758  */
evergreen_is_safe_reg(struct radeon_cs_parser * p,u32 reg)1759 static inline bool evergreen_is_safe_reg(struct radeon_cs_parser *p, u32 reg)
1760 {
1761 	struct evergreen_cs_track *track = p->track;
1762 	u32 m, i;
1763 
1764 	i = (reg >> 7);
1765 	if (unlikely(i >= REG_SAFE_BM_SIZE)) {
1766 		return false;
1767 	}
1768 	m = 1 << ((reg >> 2) & 31);
1769 	if (!(track->reg_safe_bm[i] & m))
1770 		return true;
1771 
1772 	return false;
1773 }
1774 
evergreen_packet3_check(struct radeon_cs_parser * p,struct radeon_cs_packet * pkt)1775 static int evergreen_packet3_check(struct radeon_cs_parser *p,
1776 				   struct radeon_cs_packet *pkt)
1777 {
1778 	struct radeon_bo_list *reloc;
1779 	struct evergreen_cs_track *track;
1780 	uint32_t *ib;
1781 	unsigned idx;
1782 	unsigned i;
1783 	unsigned start_reg, end_reg, reg;
1784 	int r;
1785 	u32 idx_value;
1786 
1787 	track = (struct evergreen_cs_track *)p->track;
1788 	ib = p->ib.ptr;
1789 	idx = pkt->idx + 1;
1790 	idx_value = radeon_get_ib_value(p, idx);
1791 
1792 	switch (pkt->opcode) {
1793 	case PACKET3_SET_PREDICATION:
1794 	{
1795 		int pred_op;
1796 		int tmp;
1797 		uint64_t offset;
1798 
1799 		if (pkt->count != 1) {
1800 			dev_warn_once(p->dev, "bad SET PREDICATION\n");
1801 			return -EINVAL;
1802 		}
1803 
1804 		tmp = radeon_get_ib_value(p, idx + 1);
1805 		pred_op = (tmp >> 16) & 0x7;
1806 
1807 		/* for the clear predicate operation */
1808 		if (pred_op == 0)
1809 			return 0;
1810 
1811 		if (pred_op > 2) {
1812 			dev_warn_once(p->dev, "bad SET PREDICATION operation %d\n", pred_op);
1813 			return -EINVAL;
1814 		}
1815 
1816 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1817 		if (r) {
1818 			dev_warn_once(p->dev, "bad SET PREDICATION\n");
1819 			return -EINVAL;
1820 		}
1821 
1822 		offset = reloc->gpu_offset +
1823 			 (idx_value & 0xfffffff0) +
1824 			 ((u64)(tmp & 0xff) << 32);
1825 
1826 		ib[idx + 0] = offset;
1827 		ib[idx + 1] = (tmp & 0xffffff00) | (upper_32_bits(offset) & 0xff);
1828 	}
1829 	break;
1830 	case PACKET3_CONTEXT_CONTROL:
1831 		if (pkt->count != 1) {
1832 			dev_warn_once(p->dev, "bad CONTEXT_CONTROL\n");
1833 			return -EINVAL;
1834 		}
1835 		break;
1836 	case PACKET3_INDEX_TYPE:
1837 	case PACKET3_NUM_INSTANCES:
1838 	case PACKET3_CLEAR_STATE:
1839 		if (pkt->count) {
1840 			dev_warn_once(p->dev, "bad INDEX_TYPE/NUM_INSTANCES/CLEAR_STATE\n");
1841 			return -EINVAL;
1842 		}
1843 		break;
1844 	case CAYMAN_PACKET3_DEALLOC_STATE:
1845 		if (p->rdev->family < CHIP_CAYMAN) {
1846 			dev_warn_once(p->dev, "bad PACKET3_DEALLOC_STATE\n");
1847 			return -EINVAL;
1848 		}
1849 		if (pkt->count) {
1850 			dev_warn_once(p->dev, "bad INDEX_TYPE/NUM_INSTANCES/CLEAR_STATE\n");
1851 			return -EINVAL;
1852 		}
1853 		break;
1854 	case PACKET3_INDEX_BASE:
1855 	{
1856 		uint64_t offset;
1857 
1858 		if (pkt->count != 1) {
1859 			dev_warn_once(p->dev, "bad INDEX_BASE\n");
1860 			return -EINVAL;
1861 		}
1862 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1863 		if (r) {
1864 			dev_warn_once(p->dev, "bad INDEX_BASE\n");
1865 			return -EINVAL;
1866 		}
1867 
1868 		offset = reloc->gpu_offset +
1869 			 idx_value +
1870 			 ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
1871 
1872 		ib[idx+0] = offset;
1873 		ib[idx+1] = upper_32_bits(offset) & 0xff;
1874 
1875 		r = evergreen_cs_track_check(p);
1876 		if (r) {
1877 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1878 			return r;
1879 		}
1880 		break;
1881 	}
1882 	case PACKET3_INDEX_BUFFER_SIZE:
1883 	{
1884 		if (pkt->count != 0) {
1885 			dev_warn_once(p->dev, "bad INDEX_BUFFER_SIZE\n");
1886 			return -EINVAL;
1887 		}
1888 		break;
1889 	}
1890 	case PACKET3_DRAW_INDEX:
1891 	{
1892 		uint64_t offset;
1893 		if (pkt->count != 3) {
1894 			dev_warn_once(p->dev, "bad DRAW_INDEX\n");
1895 			return -EINVAL;
1896 		}
1897 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1898 		if (r) {
1899 			dev_warn_once(p->dev, "bad DRAW_INDEX\n");
1900 			return -EINVAL;
1901 		}
1902 
1903 		offset = reloc->gpu_offset +
1904 			 idx_value +
1905 			 ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
1906 
1907 		ib[idx+0] = offset;
1908 		ib[idx+1] = upper_32_bits(offset) & 0xff;
1909 
1910 		r = evergreen_cs_track_check(p);
1911 		if (r) {
1912 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1913 			return r;
1914 		}
1915 		break;
1916 	}
1917 	case PACKET3_DRAW_INDEX_2:
1918 	{
1919 		uint64_t offset;
1920 
1921 		if (pkt->count != 4) {
1922 			dev_warn_once(p->dev, "bad DRAW_INDEX_2\n");
1923 			return -EINVAL;
1924 		}
1925 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
1926 		if (r) {
1927 			dev_warn_once(p->dev, "bad DRAW_INDEX_2\n");
1928 			return -EINVAL;
1929 		}
1930 
1931 		offset = reloc->gpu_offset +
1932 			 radeon_get_ib_value(p, idx+1) +
1933 			 ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
1934 
1935 		ib[idx+1] = offset;
1936 		ib[idx+2] = upper_32_bits(offset) & 0xff;
1937 
1938 		r = evergreen_cs_track_check(p);
1939 		if (r) {
1940 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1941 			return r;
1942 		}
1943 		break;
1944 	}
1945 	case PACKET3_DRAW_INDEX_AUTO:
1946 		if (pkt->count != 1) {
1947 			dev_warn_once(p->dev, "bad DRAW_INDEX_AUTO\n");
1948 			return -EINVAL;
1949 		}
1950 		r = evergreen_cs_track_check(p);
1951 		if (r) {
1952 			dev_warn_once(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
1953 			return r;
1954 		}
1955 		break;
1956 	case PACKET3_DRAW_INDEX_MULTI_AUTO:
1957 		if (pkt->count != 2) {
1958 			dev_warn_once(p->dev, "bad DRAW_INDEX_MULTI_AUTO\n");
1959 			return -EINVAL;
1960 		}
1961 		r = evergreen_cs_track_check(p);
1962 		if (r) {
1963 			dev_warn_once(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
1964 			return r;
1965 		}
1966 		break;
1967 	case PACKET3_DRAW_INDEX_IMMD:
1968 		if (pkt->count < 2) {
1969 			dev_warn_once(p->dev, "bad DRAW_INDEX_IMMD\n");
1970 			return -EINVAL;
1971 		}
1972 		r = evergreen_cs_track_check(p);
1973 		if (r) {
1974 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1975 			return r;
1976 		}
1977 		break;
1978 	case PACKET3_DRAW_INDEX_OFFSET:
1979 		if (pkt->count != 2) {
1980 			dev_warn_once(p->dev, "bad DRAW_INDEX_OFFSET\n");
1981 			return -EINVAL;
1982 		}
1983 		r = evergreen_cs_track_check(p);
1984 		if (r) {
1985 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1986 			return r;
1987 		}
1988 		break;
1989 	case PACKET3_DRAW_INDEX_OFFSET_2:
1990 		if (pkt->count != 3) {
1991 			dev_warn_once(p->dev, "bad DRAW_INDEX_OFFSET_2\n");
1992 			return -EINVAL;
1993 		}
1994 		r = evergreen_cs_track_check(p);
1995 		if (r) {
1996 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
1997 			return r;
1998 		}
1999 		break;
2000 	case PACKET3_SET_BASE:
2001 	{
2002 		/*
2003 		DW 1 HEADER Header of the packet. Shader_Type in bit 1 of the Header will correspond to the shader type of the Load, see Type-3 Packet.
2004 		   2 BASE_INDEX Bits [3:0] BASE_INDEX - Base Index specifies which base address is specified in the last two DWs.
2005 		     0001: DX11 Draw_Index_Indirect Patch Table Base: Base address for Draw_Index_Indirect data.
2006 		   3 ADDRESS_LO Bits [31:3] - Lower bits of QWORD-Aligned Address. Bits [2:0] - Reserved
2007 		   4 ADDRESS_HI Bits [31:8] - Reserved. Bits [7:0] - Upper bits of Address [47:32]
2008 		*/
2009 		if (pkt->count != 2) {
2010 			dev_warn_once(p->dev, "bad SET_BASE\n");
2011 			return -EINVAL;
2012 		}
2013 
2014 		/* currently only supporting setting indirect draw buffer base address */
2015 		if (idx_value != 1) {
2016 			dev_warn_once(p->dev, "bad SET_BASE\n");
2017 			return -EINVAL;
2018 		}
2019 
2020 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2021 		if (r) {
2022 			dev_warn_once(p->dev, "bad SET_BASE\n");
2023 			return -EINVAL;
2024 		}
2025 
2026 		track->indirect_draw_buffer_size = radeon_bo_size(reloc->robj);
2027 
2028 		ib[idx+1] = reloc->gpu_offset;
2029 		ib[idx+2] = upper_32_bits(reloc->gpu_offset) & 0xff;
2030 
2031 		break;
2032 	}
2033 	case PACKET3_DRAW_INDIRECT:
2034 	case PACKET3_DRAW_INDEX_INDIRECT:
2035 	{
2036 		u64 size = pkt->opcode == PACKET3_DRAW_INDIRECT ? 16 : 20;
2037 
2038 		/*
2039 		DW 1 HEADER
2040 		   2 DATA_OFFSET Bits [31:0] + byte aligned offset where the required data structure starts. Bits 1:0 are zero
2041 		   3 DRAW_INITIATOR Draw Initiator Register. Written to the VGT_DRAW_INITIATOR register for the assigned context
2042 		*/
2043 		if (pkt->count != 1) {
2044 			dev_warn_once(p->dev, "bad DRAW_INDIRECT\n");
2045 			return -EINVAL;
2046 		}
2047 
2048 		if (idx_value + size > track->indirect_draw_buffer_size) {
2049 			dev_warn_once(p->dev, "DRAW_INDIRECT buffer too small %u + %llu > %lu\n",
2050 				      idx_value, size, track->indirect_draw_buffer_size);
2051 			return -EINVAL;
2052 		}
2053 
2054 		r = evergreen_cs_track_check(p);
2055 		if (r) {
2056 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2057 			return r;
2058 		}
2059 		break;
2060 	}
2061 	case PACKET3_DISPATCH_DIRECT:
2062 		if (pkt->count != 3) {
2063 			dev_warn_once(p->dev, "bad DISPATCH_DIRECT\n");
2064 			return -EINVAL;
2065 		}
2066 		r = evergreen_cs_track_check(p);
2067 		if (r) {
2068 			dev_warn_once(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
2069 			return r;
2070 		}
2071 		break;
2072 	case PACKET3_DISPATCH_INDIRECT:
2073 		if (pkt->count != 1) {
2074 			dev_warn_once(p->dev, "bad DISPATCH_INDIRECT\n");
2075 			return -EINVAL;
2076 		}
2077 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2078 		if (r) {
2079 			dev_warn_once(p->dev, "bad DISPATCH_INDIRECT\n");
2080 			return -EINVAL;
2081 		}
2082 		ib[idx+0] = idx_value + (u32)(reloc->gpu_offset & 0xffffffff);
2083 		r = evergreen_cs_track_check(p);
2084 		if (r) {
2085 			dev_warn_once(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2086 			return r;
2087 		}
2088 		break;
2089 	case PACKET3_WAIT_REG_MEM:
2090 		if (pkt->count != 5) {
2091 			dev_warn_once(p->dev, "bad WAIT_REG_MEM\n");
2092 			return -EINVAL;
2093 		}
2094 		/* bit 4 is reg (0) or mem (1) */
2095 		if (idx_value & 0x10) {
2096 			uint64_t offset;
2097 
2098 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2099 			if (r) {
2100 				dev_warn_once(p->dev, "bad WAIT_REG_MEM\n");
2101 				return -EINVAL;
2102 			}
2103 
2104 			offset = reloc->gpu_offset +
2105 				 (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2106 				 ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2107 
2108 			ib[idx+1] = (ib[idx+1] & 0x3) | (offset & 0xfffffffc);
2109 			ib[idx+2] = upper_32_bits(offset) & 0xff;
2110 		} else if (idx_value & 0x100) {
2111 			dev_warn_once(p->dev, "cannot use PFP on REG wait\n");
2112 			return -EINVAL;
2113 		}
2114 		break;
2115 	case PACKET3_CP_DMA:
2116 	{
2117 		u32 command, size, info;
2118 		u64 offset, tmp;
2119 		if (pkt->count != 4) {
2120 			dev_warn_once(p->dev, "bad CP DMA\n");
2121 			return -EINVAL;
2122 		}
2123 		command = radeon_get_ib_value(p, idx+4);
2124 		size = command & 0x1fffff;
2125 		info = radeon_get_ib_value(p, idx+1);
2126 		if ((((info & 0x60000000) >> 29) != 0) || /* src = GDS or DATA */
2127 		    (((info & 0x00300000) >> 20) != 0) || /* dst = GDS */
2128 		    ((((info & 0x00300000) >> 20) == 0) &&
2129 		     (command & PACKET3_CP_DMA_CMD_DAS)) || /* dst = register */
2130 		    ((((info & 0x60000000) >> 29) == 0) &&
2131 		     (command & PACKET3_CP_DMA_CMD_SAS))) { /* src = register */
2132 			/* non mem to mem copies requires dw aligned count */
2133 			if (size % 4) {
2134 				dev_warn_once(p->dev, "CP DMA command requires dw count alignment\n");
2135 				return -EINVAL;
2136 			}
2137 		}
2138 		if (command & PACKET3_CP_DMA_CMD_SAS) {
2139 			/* src address space is register */
2140 			/* GDS is ok */
2141 			if (((info & 0x60000000) >> 29) != 1) {
2142 				dev_warn_once(p->dev, "CP DMA SAS not supported\n");
2143 				return -EINVAL;
2144 			}
2145 		} else {
2146 			if (command & PACKET3_CP_DMA_CMD_SAIC) {
2147 				dev_warn_once(p->dev, "CP DMA SAIC only supported for registers\n");
2148 				return -EINVAL;
2149 			}
2150 			/* src address space is memory */
2151 			if (((info & 0x60000000) >> 29) == 0) {
2152 				r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2153 				if (r) {
2154 					dev_warn_once(p->dev, "bad CP DMA SRC\n");
2155 					return -EINVAL;
2156 				}
2157 
2158 				tmp = radeon_get_ib_value(p, idx) +
2159 					((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
2160 
2161 				offset = reloc->gpu_offset + tmp;
2162 
2163 				if ((tmp + size) > radeon_bo_size(reloc->robj)) {
2164 					dev_warn_once(p->dev, "CP DMA src buffer too small (%llu %lu)\n",
2165 						      tmp + size, radeon_bo_size(reloc->robj));
2166 					return -EINVAL;
2167 				}
2168 
2169 				ib[idx] = offset;
2170 				ib[idx+1] = (ib[idx+1] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2171 			} else if (((info & 0x60000000) >> 29) != 2) {
2172 				dev_warn_once(p->dev, "bad CP DMA SRC_SEL\n");
2173 				return -EINVAL;
2174 			}
2175 		}
2176 		if (command & PACKET3_CP_DMA_CMD_DAS) {
2177 			/* dst address space is register */
2178 			/* GDS is ok */
2179 			if (((info & 0x00300000) >> 20) != 1) {
2180 				dev_warn_once(p->dev, "CP DMA DAS not supported\n");
2181 				return -EINVAL;
2182 			}
2183 		} else {
2184 			/* dst address space is memory */
2185 			if (command & PACKET3_CP_DMA_CMD_DAIC) {
2186 				dev_warn_once(p->dev, "CP DMA DAIC only supported for registers\n");
2187 				return -EINVAL;
2188 			}
2189 			if (((info & 0x00300000) >> 20) == 0) {
2190 				r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2191 				if (r) {
2192 					dev_warn_once(p->dev, "bad CP DMA DST\n");
2193 					return -EINVAL;
2194 				}
2195 
2196 				tmp = radeon_get_ib_value(p, idx+2) +
2197 					((u64)(radeon_get_ib_value(p, idx+3) & 0xff) << 32);
2198 
2199 				offset = reloc->gpu_offset + tmp;
2200 
2201 				if ((tmp + size) > radeon_bo_size(reloc->robj)) {
2202 					dev_warn_once(p->dev, "CP DMA dst buffer too small (%llu %lu)\n",
2203 						      tmp + size, radeon_bo_size(reloc->robj));
2204 					return -EINVAL;
2205 				}
2206 
2207 				ib[idx+2] = offset;
2208 				ib[idx+3] = upper_32_bits(offset) & 0xff;
2209 			} else {
2210 				dev_warn_once(p->dev, "bad CP DMA DST_SEL\n");
2211 				return -EINVAL;
2212 			}
2213 		}
2214 		break;
2215 	}
2216 	case PACKET3_PFP_SYNC_ME:
2217 		if (pkt->count) {
2218 			dev_warn_once(p->dev, "bad PFP_SYNC_ME\n");
2219 			return -EINVAL;
2220 		}
2221 		break;
2222 	case PACKET3_SURFACE_SYNC:
2223 		if (pkt->count != 3) {
2224 			dev_warn_once(p->dev, "bad SURFACE_SYNC\n");
2225 			return -EINVAL;
2226 		}
2227 		/* 0xffffffff/0x0 is flush all cache flag */
2228 		if (radeon_get_ib_value(p, idx + 1) != 0xffffffff ||
2229 		    radeon_get_ib_value(p, idx + 2) != 0) {
2230 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2231 			if (r) {
2232 				dev_warn_once(p->dev, "bad SURFACE_SYNC\n");
2233 				return -EINVAL;
2234 			}
2235 			ib[idx+2] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
2236 		}
2237 		break;
2238 	case PACKET3_EVENT_WRITE:
2239 		if (pkt->count != 2 && pkt->count != 0) {
2240 			dev_warn_once(p->dev, "bad EVENT_WRITE\n");
2241 			return -EINVAL;
2242 		}
2243 		if (pkt->count) {
2244 			uint64_t offset;
2245 
2246 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2247 			if (r) {
2248 				dev_warn_once(p->dev, "bad EVENT_WRITE\n");
2249 				return -EINVAL;
2250 			}
2251 			offset = reloc->gpu_offset +
2252 				 (radeon_get_ib_value(p, idx+1) & 0xfffffff8) +
2253 				 ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2254 
2255 			ib[idx+1] = offset & 0xfffffff8;
2256 			ib[idx+2] = upper_32_bits(offset) & 0xff;
2257 		}
2258 		break;
2259 	case PACKET3_EVENT_WRITE_EOP:
2260 	{
2261 		uint64_t offset;
2262 
2263 		if (pkt->count != 4) {
2264 			dev_warn_once(p->dev, "bad EVENT_WRITE_EOP\n");
2265 			return -EINVAL;
2266 		}
2267 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2268 		if (r) {
2269 			dev_warn_once(p->dev, "bad EVENT_WRITE_EOP\n");
2270 			return -EINVAL;
2271 		}
2272 
2273 		offset = reloc->gpu_offset +
2274 			 (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2275 			 ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2276 
2277 		ib[idx+1] = offset & 0xfffffffc;
2278 		ib[idx+2] = (ib[idx+2] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2279 		break;
2280 	}
2281 	case PACKET3_EVENT_WRITE_EOS:
2282 	{
2283 		uint64_t offset;
2284 
2285 		if (pkt->count != 3) {
2286 			dev_warn_once(p->dev, "bad EVENT_WRITE_EOS\n");
2287 			return -EINVAL;
2288 		}
2289 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2290 		if (r) {
2291 			dev_warn_once(p->dev, "bad EVENT_WRITE_EOS\n");
2292 			return -EINVAL;
2293 		}
2294 
2295 		offset = reloc->gpu_offset +
2296 			 (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2297 			 ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2298 
2299 		ib[idx+1] = offset & 0xfffffffc;
2300 		ib[idx+2] = (ib[idx+2] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2301 		break;
2302 	}
2303 	case PACKET3_SET_CONFIG_REG:
2304 		start_reg = (idx_value << 2) + PACKET3_SET_CONFIG_REG_START;
2305 		end_reg = 4 * pkt->count + start_reg - 4;
2306 		if ((start_reg < PACKET3_SET_CONFIG_REG_START) ||
2307 		    (start_reg >= PACKET3_SET_CONFIG_REG_END) ||
2308 		    (end_reg >= PACKET3_SET_CONFIG_REG_END)) {
2309 			dev_warn_once(p->dev, "bad PACKET3_SET_CONFIG_REG\n");
2310 			return -EINVAL;
2311 		}
2312 		for (reg = start_reg, idx++; reg <= end_reg; reg += 4, idx++) {
2313 			if (evergreen_is_safe_reg(p, reg))
2314 				continue;
2315 			r = evergreen_cs_handle_reg(p, reg, idx);
2316 			if (r)
2317 				return r;
2318 		}
2319 		break;
2320 	case PACKET3_SET_CONTEXT_REG:
2321 		start_reg = (idx_value << 2) + PACKET3_SET_CONTEXT_REG_START;
2322 		end_reg = 4 * pkt->count + start_reg - 4;
2323 		if ((start_reg < PACKET3_SET_CONTEXT_REG_START) ||
2324 		    (start_reg >= PACKET3_SET_CONTEXT_REG_END) ||
2325 		    (end_reg >= PACKET3_SET_CONTEXT_REG_END)) {
2326 			dev_warn_once(p->dev, "bad PACKET3_SET_CONTEXT_REG\n");
2327 			return -EINVAL;
2328 		}
2329 		for (reg = start_reg, idx++; reg <= end_reg; reg += 4, idx++) {
2330 			if (evergreen_is_safe_reg(p, reg))
2331 				continue;
2332 			r = evergreen_cs_handle_reg(p, reg, idx);
2333 			if (r)
2334 				return r;
2335 		}
2336 		break;
2337 	case PACKET3_SET_RESOURCE:
2338 		if (pkt->count % 8) {
2339 			dev_warn_once(p->dev, "bad SET_RESOURCE\n");
2340 			return -EINVAL;
2341 		}
2342 		start_reg = (idx_value << 2) + PACKET3_SET_RESOURCE_START;
2343 		end_reg = 4 * pkt->count + start_reg - 4;
2344 		if ((start_reg < PACKET3_SET_RESOURCE_START) ||
2345 		    (start_reg >= PACKET3_SET_RESOURCE_END) ||
2346 		    (end_reg >= PACKET3_SET_RESOURCE_END)) {
2347 			dev_warn_once(p->dev, "bad SET_RESOURCE\n");
2348 			return -EINVAL;
2349 		}
2350 		for (i = 0; i < (pkt->count / 8); i++) {
2351 			struct radeon_bo *texture, *mipmap;
2352 			u32 toffset, moffset;
2353 			u32 size, offset, mip_address, tex_dim;
2354 
2355 			switch (G__SQ_CONSTANT_TYPE(radeon_get_ib_value(p, idx+1+(i*8)+7))) {
2356 			case SQ_TEX_VTX_VALID_TEXTURE:
2357 				/* tex base */
2358 				r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2359 				if (r) {
2360 					dev_warn_once(p->dev, "bad SET_RESOURCE (tex)\n");
2361 					return -EINVAL;
2362 				}
2363 				if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
2364 					ib[idx+1+(i*8)+1] |=
2365 						TEX_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
2366 					if (reloc->tiling_flags & RADEON_TILING_MACRO) {
2367 						unsigned bankw, bankh, mtaspect, tile_split;
2368 
2369 						evergreen_tiling_fields(reloc->tiling_flags,
2370 									&bankw, &bankh, &mtaspect,
2371 									&tile_split);
2372 						ib[idx+1+(i*8)+6] |= TEX_TILE_SPLIT(tile_split);
2373 						ib[idx+1+(i*8)+7] |=
2374 							TEX_BANK_WIDTH(bankw) |
2375 							TEX_BANK_HEIGHT(bankh) |
2376 							MACRO_TILE_ASPECT(mtaspect) |
2377 							TEX_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
2378 					}
2379 				}
2380 				texture = reloc->robj;
2381 				toffset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
2382 
2383 				/* tex mip base */
2384 				tex_dim = ib[idx+1+(i*8)+0] & 0x7;
2385 				mip_address = ib[idx+1+(i*8)+3];
2386 
2387 				if ((tex_dim == SQ_TEX_DIM_2D_MSAA || tex_dim == SQ_TEX_DIM_2D_ARRAY_MSAA) &&
2388 				    !mip_address &&
2389 				    !radeon_cs_packet_next_is_pkt3_nop(p)) {
2390 					/* MIP_ADDRESS should point to FMASK for an MSAA texture.
2391 					 * It should be 0 if FMASK is disabled. */
2392 					moffset = 0;
2393 					mipmap = NULL;
2394 				} else {
2395 					r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2396 					if (r) {
2397 						dev_warn_once(p->dev, "bad SET_RESOURCE (tex)\n");
2398 						return -EINVAL;
2399 					}
2400 					moffset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
2401 					mipmap = reloc->robj;
2402 				}
2403 
2404 				r = evergreen_cs_track_validate_texture(p, texture, mipmap, idx+1+(i*8));
2405 				if (r)
2406 					return r;
2407 				ib[idx+1+(i*8)+2] += toffset;
2408 				ib[idx+1+(i*8)+3] += moffset;
2409 				break;
2410 			case SQ_TEX_VTX_VALID_BUFFER:
2411 			{
2412 				uint64_t offset64;
2413 				/* vtx base */
2414 				r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2415 				if (r) {
2416 					dev_warn_once(p->dev, "bad SET_RESOURCE (vtx)\n");
2417 					return -EINVAL;
2418 				}
2419 				offset = radeon_get_ib_value(p, idx+1+(i*8)+0);
2420 				size = radeon_get_ib_value(p, idx+1+(i*8)+1);
2421 				if (p->rdev && (size + offset) > radeon_bo_size(reloc->robj)) {
2422 					/* force size to size of the buffer */
2423 					dev_warn_once(p->dev, "vbo resource seems too big (%d) for the bo (%ld)\n",
2424 						      size + offset, radeon_bo_size(reloc->robj));
2425 					ib[idx+1+(i*8)+1] = radeon_bo_size(reloc->robj) - offset;
2426 				}
2427 
2428 				offset64 = reloc->gpu_offset + offset;
2429 				ib[idx+1+(i*8)+0] = offset64;
2430 				ib[idx+1+(i*8)+2] = (ib[idx+1+(i*8)+2] & 0xffffff00) |
2431 						    (upper_32_bits(offset64) & 0xff);
2432 				break;
2433 			}
2434 			case SQ_TEX_VTX_INVALID_TEXTURE:
2435 			case SQ_TEX_VTX_INVALID_BUFFER:
2436 			default:
2437 				dev_warn_once(p->dev, "bad SET_RESOURCE\n");
2438 				return -EINVAL;
2439 			}
2440 		}
2441 		break;
2442 	case PACKET3_SET_ALU_CONST:
2443 		/* XXX fix me ALU const buffers only */
2444 		break;
2445 	case PACKET3_SET_BOOL_CONST:
2446 		start_reg = (idx_value << 2) + PACKET3_SET_BOOL_CONST_START;
2447 		end_reg = 4 * pkt->count + start_reg - 4;
2448 		if ((start_reg < PACKET3_SET_BOOL_CONST_START) ||
2449 		    (start_reg >= PACKET3_SET_BOOL_CONST_END) ||
2450 		    (end_reg >= PACKET3_SET_BOOL_CONST_END)) {
2451 			dev_warn_once(p->dev, "bad SET_BOOL_CONST\n");
2452 			return -EINVAL;
2453 		}
2454 		break;
2455 	case PACKET3_SET_LOOP_CONST:
2456 		start_reg = (idx_value << 2) + PACKET3_SET_LOOP_CONST_START;
2457 		end_reg = 4 * pkt->count + start_reg - 4;
2458 		if ((start_reg < PACKET3_SET_LOOP_CONST_START) ||
2459 		    (start_reg >= PACKET3_SET_LOOP_CONST_END) ||
2460 		    (end_reg >= PACKET3_SET_LOOP_CONST_END)) {
2461 			dev_warn_once(p->dev, "bad SET_LOOP_CONST\n");
2462 			return -EINVAL;
2463 		}
2464 		break;
2465 	case PACKET3_SET_CTL_CONST:
2466 		start_reg = (idx_value << 2) + PACKET3_SET_CTL_CONST_START;
2467 		end_reg = 4 * pkt->count + start_reg - 4;
2468 		if ((start_reg < PACKET3_SET_CTL_CONST_START) ||
2469 		    (start_reg >= PACKET3_SET_CTL_CONST_END) ||
2470 		    (end_reg >= PACKET3_SET_CTL_CONST_END)) {
2471 			dev_warn_once(p->dev, "bad SET_CTL_CONST\n");
2472 			return -EINVAL;
2473 		}
2474 		break;
2475 	case PACKET3_SET_SAMPLER:
2476 		if (pkt->count % 3) {
2477 			dev_warn_once(p->dev, "bad SET_SAMPLER\n");
2478 			return -EINVAL;
2479 		}
2480 		start_reg = (idx_value << 2) + PACKET3_SET_SAMPLER_START;
2481 		end_reg = 4 * pkt->count + start_reg - 4;
2482 		if ((start_reg < PACKET3_SET_SAMPLER_START) ||
2483 		    (start_reg >= PACKET3_SET_SAMPLER_END) ||
2484 		    (end_reg >= PACKET3_SET_SAMPLER_END)) {
2485 			dev_warn_once(p->dev, "bad SET_SAMPLER\n");
2486 			return -EINVAL;
2487 		}
2488 		break;
2489 	case PACKET3_STRMOUT_BUFFER_UPDATE:
2490 		if (pkt->count != 4) {
2491 			dev_warn_once(p->dev, "bad STRMOUT_BUFFER_UPDATE (invalid count)\n");
2492 			return -EINVAL;
2493 		}
2494 		/* Updating memory at DST_ADDRESS. */
2495 		if (idx_value & 0x1) {
2496 			u64 offset;
2497 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2498 			if (r) {
2499 				dev_warn_once(p->dev, "bad STRMOUT_BUFFER_UPDATE (missing dst reloc)\n");
2500 				return -EINVAL;
2501 			}
2502 			offset = radeon_get_ib_value(p, idx+1);
2503 			offset += ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2504 			if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2505 				dev_warn_once(p->dev, "bad STRMOUT_BUFFER_UPDATE dst bo too small: 0x%llx, 0x%lx\n",
2506 					      offset + 4, radeon_bo_size(reloc->robj));
2507 				return -EINVAL;
2508 			}
2509 			offset += reloc->gpu_offset;
2510 			ib[idx+1] = offset;
2511 			ib[idx+2] = upper_32_bits(offset) & 0xff;
2512 		}
2513 		/* Reading data from SRC_ADDRESS. */
2514 		if (((idx_value >> 1) & 0x3) == 2) {
2515 			u64 offset;
2516 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2517 			if (r) {
2518 				dev_warn_once(p->dev, "bad STRMOUT_BUFFER_UPDATE (missing src reloc)\n");
2519 				return -EINVAL;
2520 			}
2521 			offset = radeon_get_ib_value(p, idx+3);
2522 			offset += ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
2523 			if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2524 				dev_warn_once(p->dev, "bad STRMOUT_BUFFER_UPDATE src bo too small: 0x%llx, 0x%lx\n",
2525 					      offset + 4, radeon_bo_size(reloc->robj));
2526 				return -EINVAL;
2527 			}
2528 			offset += reloc->gpu_offset;
2529 			ib[idx+3] = offset;
2530 			ib[idx+4] = upper_32_bits(offset) & 0xff;
2531 		}
2532 		break;
2533 	case PACKET3_MEM_WRITE:
2534 	{
2535 		u64 offset;
2536 
2537 		if (pkt->count != 3) {
2538 			dev_warn_once(p->dev, "bad MEM_WRITE (invalid count)\n");
2539 			return -EINVAL;
2540 		}
2541 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2542 		if (r) {
2543 			dev_warn_once(p->dev, "bad MEM_WRITE (missing reloc)\n");
2544 			return -EINVAL;
2545 		}
2546 		offset = radeon_get_ib_value(p, idx+0);
2547 		offset += ((u64)(radeon_get_ib_value(p, idx+1) & 0xff)) << 32UL;
2548 		if (offset & 0x7) {
2549 			dev_warn_once(p->dev, "bad MEM_WRITE (address not qwords aligned)\n");
2550 			return -EINVAL;
2551 		}
2552 		if ((offset + 8) > radeon_bo_size(reloc->robj)) {
2553 			dev_warn_once(p->dev, "bad MEM_WRITE bo too small: 0x%llx, 0x%lx\n",
2554 				      offset + 8, radeon_bo_size(reloc->robj));
2555 			return -EINVAL;
2556 		}
2557 		offset += reloc->gpu_offset;
2558 		ib[idx+0] = offset;
2559 		ib[idx+1] = upper_32_bits(offset) & 0xff;
2560 		break;
2561 	}
2562 	case PACKET3_COPY_DW:
2563 		if (pkt->count != 4) {
2564 			dev_warn_once(p->dev, "bad COPY_DW (invalid count)\n");
2565 			return -EINVAL;
2566 		}
2567 		if (idx_value & 0x1) {
2568 			u64 offset;
2569 			/* SRC is memory. */
2570 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2571 			if (r) {
2572 				dev_warn_once(p->dev, "bad COPY_DW (missing src reloc)\n");
2573 				return -EINVAL;
2574 			}
2575 			offset = radeon_get_ib_value(p, idx+1);
2576 			offset += ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2577 			if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2578 				dev_warn_once(p->dev, "bad COPY_DW src bo too small: 0x%llx, 0x%lx\n",
2579 					      offset + 4, radeon_bo_size(reloc->robj));
2580 				return -EINVAL;
2581 			}
2582 			offset += reloc->gpu_offset;
2583 			ib[idx+1] = offset;
2584 			ib[idx+2] = upper_32_bits(offset) & 0xff;
2585 		} else {
2586 			/* SRC is a reg. */
2587 			reg = radeon_get_ib_value(p, idx+1) << 2;
2588 			if (!evergreen_is_safe_reg(p, reg)) {
2589 				dev_warn_once(p->dev, "forbidden register 0x%08x at %d\n",
2590 					      reg, idx + 1);
2591 				return -EINVAL;
2592 			}
2593 		}
2594 		if (idx_value & 0x2) {
2595 			u64 offset;
2596 			/* DST is memory. */
2597 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2598 			if (r) {
2599 				dev_warn_once(p->dev, "bad COPY_DW (missing dst reloc)\n");
2600 				return -EINVAL;
2601 			}
2602 			offset = radeon_get_ib_value(p, idx+3);
2603 			offset += ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
2604 			if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2605 				dev_warn_once(p->dev, "bad COPY_DW dst bo too small: 0x%llx, 0x%lx\n",
2606 					      offset + 4, radeon_bo_size(reloc->robj));
2607 				return -EINVAL;
2608 			}
2609 			offset += reloc->gpu_offset;
2610 			ib[idx+3] = offset;
2611 			ib[idx+4] = upper_32_bits(offset) & 0xff;
2612 		} else {
2613 			/* DST is a reg. */
2614 			reg = radeon_get_ib_value(p, idx+3) << 2;
2615 			if (!evergreen_is_safe_reg(p, reg)) {
2616 				dev_warn_once(p->dev, "forbidden register 0x%08x at %d\n",
2617 					      reg, idx + 3);
2618 				return -EINVAL;
2619 			}
2620 		}
2621 		break;
2622 	case PACKET3_SET_APPEND_CNT:
2623 	{
2624 		uint32_t areg;
2625 		uint32_t allowed_reg_base;
2626 		uint32_t source_sel;
2627 		if (pkt->count != 2) {
2628 			dev_warn_once(p->dev, "bad SET_APPEND_CNT (invalid count)\n");
2629 			return -EINVAL;
2630 		}
2631 
2632 		allowed_reg_base = GDS_APPEND_COUNT_0;
2633 		allowed_reg_base -= PACKET3_SET_CONTEXT_REG_START;
2634 		allowed_reg_base >>= 2;
2635 
2636 		areg = idx_value >> 16;
2637 		if (areg < allowed_reg_base || areg > (allowed_reg_base + 11)) {
2638 			dev_warn_once(p->dev, "forbidden register for append cnt 0x%08x at %d\n",
2639 				      areg, idx);
2640 			return -EINVAL;
2641 		}
2642 
2643 		source_sel = G_PACKET3_SET_APPEND_CNT_SRC_SELECT(idx_value);
2644 		if (source_sel == PACKET3_SAC_SRC_SEL_MEM) {
2645 			uint64_t offset;
2646 			uint32_t swap;
2647 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2648 			if (r) {
2649 				dev_warn_once(p->dev, "bad SET_APPEND_CNT (missing reloc)\n");
2650 				return -EINVAL;
2651 			}
2652 			offset = radeon_get_ib_value(p, idx + 1);
2653 			swap = offset & 0x3;
2654 			offset &= ~0x3;
2655 
2656 			offset += ((u64)(radeon_get_ib_value(p, idx + 2) & 0xff)) << 32;
2657 
2658 			offset += reloc->gpu_offset;
2659 			ib[idx+1] = (offset & 0xfffffffc) | swap;
2660 			ib[idx+2] = upper_32_bits(offset) & 0xff;
2661 		} else {
2662 			dev_warn_once(p->dev, "bad SET_APPEND_CNT (unsupported operation)\n");
2663 			return -EINVAL;
2664 		}
2665 		break;
2666 	}
2667 	case PACKET3_COND_EXEC:
2668 	{
2669 		u64 offset;
2670 
2671 		if (pkt->count != 2) {
2672 			dev_warn_once(p->dev, "bad COND_EXEC (invalid count)\n");
2673 			return -EINVAL;
2674 		}
2675 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2676 		if (r) {
2677 			dev_warn_once(p->dev, "bad COND_EXEC (missing reloc)\n");
2678 			return -EINVAL;
2679 		}
2680 		offset = radeon_get_ib_value(p, idx + 0);
2681 		offset += ((u64)(radeon_get_ib_value(p, idx + 1) & 0xff)) << 32UL;
2682 		if (offset & 0x7) {
2683 			dev_warn_once(p->dev, "bad COND_EXEC (address not qwords aligned)\n");
2684 			return -EINVAL;
2685 		}
2686 		if ((offset + 8) > radeon_bo_size(reloc->robj)) {
2687 			dev_warn_once(p->dev, "bad COND_EXEC bo too small: 0x%llx, 0x%lx\n",
2688 				      offset + 8, radeon_bo_size(reloc->robj));
2689 			return -EINVAL;
2690 		}
2691 		offset += reloc->gpu_offset;
2692 		ib[idx + 0] = offset;
2693 		ib[idx + 1] = upper_32_bits(offset) & 0xff;
2694 		break;
2695 	}
2696 	case PACKET3_COND_WRITE:
2697 		if (pkt->count != 7) {
2698 			dev_warn_once(p->dev, "bad COND_WRITE (invalid count)\n");
2699 			return -EINVAL;
2700 		}
2701 		if (idx_value & 0x10) {
2702 			u64 offset;
2703 			/* POLL is memory. */
2704 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2705 			if (r) {
2706 				dev_warn_once(p->dev, "bad COND_WRITE (missing src reloc)\n");
2707 				return -EINVAL;
2708 			}
2709 			offset = radeon_get_ib_value(p, idx + 1);
2710 			offset += ((u64)(radeon_get_ib_value(p, idx + 2) & 0xff)) << 32;
2711 			if ((offset + 8) > radeon_bo_size(reloc->robj)) {
2712 				dev_warn_once(p->dev, "bad COND_WRITE src bo too small: 0x%llx, 0x%lx\n",
2713 					      offset + 8, radeon_bo_size(reloc->robj));
2714 				return -EINVAL;
2715 			}
2716 			offset += reloc->gpu_offset;
2717 			ib[idx + 1] = offset;
2718 			ib[idx + 2] = upper_32_bits(offset) & 0xff;
2719 		} else {
2720 			/* POLL is a reg. */
2721 			reg = radeon_get_ib_value(p, idx + 1) << 2;
2722 			if (!evergreen_is_safe_reg(p, reg)) {
2723 				dev_warn_once(p->dev, "forbidden register 0x%08x at %d\n",
2724 					      reg, idx + 1);
2725 				return -EINVAL;
2726 			}
2727 		}
2728 		if (idx_value & 0x100) {
2729 			u64 offset;
2730 			/* WRITE is memory. */
2731 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
2732 			if (r) {
2733 				dev_warn_once(p->dev, "bad COND_WRITE (missing dst reloc)\n");
2734 				return -EINVAL;
2735 			}
2736 			offset = radeon_get_ib_value(p, idx + 5);
2737 			offset += ((u64)(radeon_get_ib_value(p, idx + 6) & 0xff)) << 32;
2738 			if ((offset + 8) > radeon_bo_size(reloc->robj)) {
2739 				dev_warn_once(p->dev, "bad COND_WRITE dst bo too small: 0x%llx, 0x%lx\n",
2740 					      offset + 8, radeon_bo_size(reloc->robj));
2741 				return -EINVAL;
2742 			}
2743 			offset += reloc->gpu_offset;
2744 			ib[idx + 5] = offset;
2745 			ib[idx + 6] = upper_32_bits(offset) & 0xff;
2746 		} else {
2747 			/* WRITE is a reg. */
2748 			reg = radeon_get_ib_value(p, idx + 5) << 2;
2749 			if (!evergreen_is_safe_reg(p, reg)) {
2750 				dev_warn_once(p->dev, "forbidden register 0x%08x at %d\n",
2751 					      reg, idx + 5);
2752 				return -EINVAL;
2753 			}
2754 		}
2755 		break;
2756 	case PACKET3_NOP:
2757 		break;
2758 	default:
2759 		dev_warn_once(p->dev, "Packet3 opcode %x not supported\n", pkt->opcode);
2760 		return -EINVAL;
2761 	}
2762 	return 0;
2763 }
2764 
evergreen_cs_parse(struct radeon_cs_parser * p)2765 int evergreen_cs_parse(struct radeon_cs_parser *p)
2766 {
2767 	struct radeon_cs_packet pkt;
2768 	struct evergreen_cs_track *track;
2769 	u32 tmp;
2770 	int r;
2771 
2772 	if (p->track == NULL) {
2773 		/* initialize tracker, we are in kms */
2774 		track = kzalloc_obj(*track);
2775 		if (track == NULL)
2776 			return -ENOMEM;
2777 		evergreen_cs_track_init(track);
2778 		if (p->rdev->family >= CHIP_CAYMAN) {
2779 			tmp = p->rdev->config.cayman.tile_config;
2780 			track->reg_safe_bm = cayman_reg_safe_bm;
2781 		} else {
2782 			tmp = p->rdev->config.evergreen.tile_config;
2783 			track->reg_safe_bm = evergreen_reg_safe_bm;
2784 		}
2785 		BUILD_BUG_ON(ARRAY_SIZE(cayman_reg_safe_bm) != REG_SAFE_BM_SIZE);
2786 		BUILD_BUG_ON(ARRAY_SIZE(evergreen_reg_safe_bm) != REG_SAFE_BM_SIZE);
2787 		switch (tmp & 0xf) {
2788 		case 0:
2789 			track->npipes = 1;
2790 			break;
2791 		case 1:
2792 		default:
2793 			track->npipes = 2;
2794 			break;
2795 		case 2:
2796 			track->npipes = 4;
2797 			break;
2798 		case 3:
2799 			track->npipes = 8;
2800 			break;
2801 		}
2802 
2803 		switch ((tmp & 0xf0) >> 4) {
2804 		case 0:
2805 			track->nbanks = 4;
2806 			break;
2807 		case 1:
2808 		default:
2809 			track->nbanks = 8;
2810 			break;
2811 		case 2:
2812 			track->nbanks = 16;
2813 			break;
2814 		}
2815 
2816 		switch ((tmp & 0xf00) >> 8) {
2817 		case 0:
2818 			track->group_size = 256;
2819 			break;
2820 		case 1:
2821 		default:
2822 			track->group_size = 512;
2823 			break;
2824 		}
2825 
2826 		switch ((tmp & 0xf000) >> 12) {
2827 		case 0:
2828 			track->row_size = 1;
2829 			break;
2830 		case 1:
2831 		default:
2832 			track->row_size = 2;
2833 			break;
2834 		case 2:
2835 			track->row_size = 4;
2836 			break;
2837 		}
2838 
2839 		p->track = track;
2840 	}
2841 	do {
2842 		r = radeon_cs_packet_parse(p, &pkt, p->idx);
2843 		if (r) {
2844 			kfree(p->track);
2845 			p->track = NULL;
2846 			return r;
2847 		}
2848 		p->idx += pkt.count + 2;
2849 		switch (pkt.type) {
2850 		case RADEON_PACKET_TYPE0:
2851 			r = evergreen_cs_parse_packet0(p, &pkt);
2852 			break;
2853 		case RADEON_PACKET_TYPE2:
2854 			break;
2855 		case RADEON_PACKET_TYPE3:
2856 			r = evergreen_packet3_check(p, &pkt);
2857 			break;
2858 		default:
2859 			dev_warn_once(p->dev, "Unknown packet type %d !\n", pkt.type);
2860 			kfree(p->track);
2861 			p->track = NULL;
2862 			return -EINVAL;
2863 		}
2864 		if (r) {
2865 			kfree(p->track);
2866 			p->track = NULL;
2867 			return r;
2868 		}
2869 	} while (p->idx < p->chunk_ib->length_dw);
2870 #if 0
2871 	for (r = 0; r < p->ib.length_dw; r++) {
2872 		pr_info("%05d  0x%08X\n", r, p->ib.ptr[r]);
2873 		mdelay(1);
2874 	}
2875 #endif
2876 	kfree(p->track);
2877 	p->track = NULL;
2878 	return 0;
2879 }
2880 
2881 /**
2882  * evergreen_dma_cs_parse() - parse the DMA IB
2883  * @p:		parser structure holding parsing context.
2884  *
2885  * Parses the DMA IB from the CS ioctl and updates
2886  * the GPU addresses based on the reloc information and
2887  * checks for errors. (Evergreen-Cayman)
2888  * Returns 0 for success and an error on failure.
2889  **/
evergreen_dma_cs_parse(struct radeon_cs_parser * p)2890 int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
2891 {
2892 	struct radeon_cs_chunk *ib_chunk = p->chunk_ib;
2893 	struct radeon_bo_list *src_reloc, *dst_reloc, *dst2_reloc;
2894 	u32 header, cmd, count, sub_cmd;
2895 	uint32_t *ib = p->ib.ptr;
2896 	u32 idx;
2897 	u64 src_offset, dst_offset, dst2_offset;
2898 	int r;
2899 
2900 	do {
2901 		if (p->idx >= ib_chunk->length_dw) {
2902 			dev_warn_once(p->dev, "Can not parse packet at %d after CS end %d !\n",
2903 				      p->idx, ib_chunk->length_dw);
2904 			return -EINVAL;
2905 		}
2906 		idx = p->idx;
2907 		header = radeon_get_ib_value(p, idx);
2908 		cmd = GET_DMA_CMD(header);
2909 		count = GET_DMA_COUNT(header);
2910 		sub_cmd = GET_DMA_SUB_CMD(header);
2911 
2912 		switch (cmd) {
2913 		case DMA_PACKET_WRITE:
2914 			r = r600_dma_cs_next_reloc(p, &dst_reloc);
2915 			if (r) {
2916 				dev_warn_once(p->dev, "bad DMA_PACKET_WRITE\n");
2917 				return -EINVAL;
2918 			}
2919 			switch (sub_cmd) {
2920 			/* tiled */
2921 			case 8:
2922 				dst_offset = radeon_get_ib_value(p, idx+1);
2923 				dst_offset <<= 8;
2924 
2925 				ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
2926 				p->idx += count + 7;
2927 				break;
2928 			/* linear */
2929 			case 0:
2930 				dst_offset = radeon_get_ib_value(p, idx+1);
2931 				dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2932 
2933 				ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
2934 				ib[idx+2] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
2935 				p->idx += count + 3;
2936 				break;
2937 			default:
2938 				dev_warn_once(p->dev, "bad DMA_PACKET_WRITE [%6d] 0x%08x sub cmd is not 0 or 8\n", idx, header);
2939 				return -EINVAL;
2940 			}
2941 			if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
2942 				dev_warn_once(p->dev, "DMA write buffer too small (%llu %lu)\n",
2943 					      dst_offset, radeon_bo_size(dst_reloc->robj));
2944 				return -EINVAL;
2945 			}
2946 			break;
2947 		case DMA_PACKET_COPY:
2948 			r = r600_dma_cs_next_reloc(p, &src_reloc);
2949 			if (r) {
2950 				dev_warn_once(p->dev, "bad DMA_PACKET_COPY\n");
2951 				return -EINVAL;
2952 			}
2953 			r = r600_dma_cs_next_reloc(p, &dst_reloc);
2954 			if (r) {
2955 				dev_warn_once(p->dev, "bad DMA_PACKET_COPY\n");
2956 				return -EINVAL;
2957 			}
2958 			switch (sub_cmd) {
2959 			/* Copy L2L, DW aligned */
2960 			case 0x00:
2961 				/* L2L, dw */
2962 				src_offset = radeon_get_ib_value(p, idx+2);
2963 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
2964 				dst_offset = radeon_get_ib_value(p, idx+1);
2965 				dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
2966 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
2967 					dev_warn_once(p->dev, "DMA L2L, dw src buffer too small (%llu %lu)\n",
2968 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
2969 					return -EINVAL;
2970 				}
2971 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
2972 					dev_warn_once(p->dev, "DMA L2L, dw dst buffer too small (%llu %lu)\n",
2973 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
2974 					return -EINVAL;
2975 				}
2976 				ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
2977 				ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
2978 				ib[idx+3] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
2979 				ib[idx+4] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
2980 				p->idx += 5;
2981 				break;
2982 			/* Copy L2T/T2L */
2983 			case 0x08:
2984 				/* detile bit */
2985 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
2986 					/* tiled src, linear dst */
2987 					src_offset = radeon_get_ib_value(p, idx+1);
2988 					src_offset <<= 8;
2989 					ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
2990 
2991 					dst_offset = radeon_get_ib_value(p, idx + 7);
2992 					dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
2993 					ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
2994 					ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
2995 				} else {
2996 					/* linear src, tiled dst */
2997 					src_offset = radeon_get_ib_value(p, idx+7);
2998 					src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
2999 					ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3000 					ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3001 
3002 					dst_offset = radeon_get_ib_value(p, idx+1);
3003 					dst_offset <<= 8;
3004 					ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3005 				}
3006 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3007 					dev_warn_once(p->dev, "DMA L2T, src buffer too small (%llu %lu)\n",
3008 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3009 					return -EINVAL;
3010 				}
3011 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3012 					dev_warn_once(p->dev, "DMA L2T, dst buffer too small (%llu %lu)\n",
3013 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3014 					return -EINVAL;
3015 				}
3016 				p->idx += 9;
3017 				break;
3018 			/* Copy L2L, byte aligned */
3019 			case 0x40:
3020 				/* L2L, byte */
3021 				src_offset = radeon_get_ib_value(p, idx+2);
3022 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
3023 				dst_offset = radeon_get_ib_value(p, idx+1);
3024 				dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
3025 				if ((src_offset + count) > radeon_bo_size(src_reloc->robj)) {
3026 					dev_warn_once(p->dev, "DMA L2L, byte src buffer too small (%llu %lu)\n",
3027 						      src_offset + count, radeon_bo_size(src_reloc->robj));
3028 					return -EINVAL;
3029 				}
3030 				if ((dst_offset + count) > radeon_bo_size(dst_reloc->robj)) {
3031 					dev_warn_once(p->dev, "DMA L2L, byte dst buffer too small (%llu %lu)\n",
3032 						      dst_offset + count, radeon_bo_size(dst_reloc->robj));
3033 					return -EINVAL;
3034 				}
3035 				ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xffffffff);
3036 				ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xffffffff);
3037 				ib[idx+3] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
3038 				ib[idx+4] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3039 				p->idx += 5;
3040 				break;
3041 			/* Copy L2L, partial */
3042 			case 0x41:
3043 				/* L2L, partial */
3044 				if (p->family < CHIP_CAYMAN) {
3045 					dev_warn_once(p->dev, "L2L Partial is cayman only !\n");
3046 					return -EINVAL;
3047 				}
3048 				ib[idx+1] += (u32)(src_reloc->gpu_offset & 0xffffffff);
3049 				ib[idx+2] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3050 				ib[idx+4] += (u32)(dst_reloc->gpu_offset & 0xffffffff);
3051 				ib[idx+5] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
3052 
3053 				p->idx += 9;
3054 				break;
3055 			/* Copy L2L, DW aligned, broadcast */
3056 			case 0x44:
3057 				/* L2L, dw, broadcast */
3058 				r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3059 				if (r) {
3060 					dev_warn_once(p->dev, "bad L2L, dw, broadcast DMA_PACKET_COPY\n");
3061 					return -EINVAL;
3062 				}
3063 				dst_offset = radeon_get_ib_value(p, idx+1);
3064 				dst_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
3065 				dst2_offset = radeon_get_ib_value(p, idx+2);
3066 				dst2_offset |= ((u64)(radeon_get_ib_value(p, idx+5) & 0xff)) << 32;
3067 				src_offset = radeon_get_ib_value(p, idx+3);
3068 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
3069 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3070 					dev_warn_once(p->dev, "DMA L2L, dw, broadcast src buffer too small (%llu %lu)\n",
3071 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3072 					return -EINVAL;
3073 				}
3074 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3075 					dev_warn_once(p->dev, "DMA L2L, dw, broadcast dst buffer too small (%llu %lu)\n",
3076 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3077 					return -EINVAL;
3078 				}
3079 				if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3080 					dev_warn_once(p->dev, "DMA L2L, dw, broadcast dst2 buffer too small (%llu %lu)\n",
3081 						      dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3082 					return -EINVAL;
3083 				}
3084 				ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
3085 				ib[idx+2] += (u32)(dst2_reloc->gpu_offset & 0xfffffffc);
3086 				ib[idx+3] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3087 				ib[idx+4] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
3088 				ib[idx+5] += upper_32_bits(dst2_reloc->gpu_offset) & 0xff;
3089 				ib[idx+6] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3090 				p->idx += 7;
3091 				break;
3092 			/* Copy L2T Frame to Field */
3093 			case 0x48:
3094 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
3095 					dev_warn_once(p->dev, "bad L2T, frame to fields DMA_PACKET_COPY\n");
3096 					return -EINVAL;
3097 				}
3098 				r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3099 				if (r) {
3100 					dev_warn_once(p->dev, "bad L2T, frame to fields DMA_PACKET_COPY\n");
3101 					return -EINVAL;
3102 				}
3103 				dst_offset = radeon_get_ib_value(p, idx+1);
3104 				dst_offset <<= 8;
3105 				dst2_offset = radeon_get_ib_value(p, idx+2);
3106 				dst2_offset <<= 8;
3107 				src_offset = radeon_get_ib_value(p, idx+8);
3108 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
3109 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3110 					dev_warn_once(p->dev, "DMA L2T, frame to fields src buffer too small (%llu %lu)\n",
3111 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3112 					return -EINVAL;
3113 				}
3114 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3115 					dev_warn_once(p->dev, "DMA L2T, frame to fields buffer too small (%llu %lu)\n",
3116 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3117 					return -EINVAL;
3118 				}
3119 				if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3120 					dev_warn_once(p->dev, "DMA L2T, frame to fields buffer too small (%llu %lu)\n",
3121 						      dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3122 					return -EINVAL;
3123 				}
3124 				ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3125 				ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
3126 				ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3127 				ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3128 				p->idx += 10;
3129 				break;
3130 			/* Copy L2T/T2L, partial */
3131 			case 0x49:
3132 				/* L2T, T2L partial */
3133 				if (p->family < CHIP_CAYMAN) {
3134 					dev_warn_once(p->dev, "L2T, T2L Partial is cayman only !\n");
3135 					return -EINVAL;
3136 				}
3137 				/* detile bit */
3138 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
3139 					/* tiled src, linear dst */
3140 					ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
3141 
3142 					ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
3143 					ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
3144 				} else {
3145 					/* linear src, tiled dst */
3146 					ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3147 					ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3148 
3149 					ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3150 				}
3151 				p->idx += 12;
3152 				break;
3153 			/* Copy L2T broadcast */
3154 			case 0x4b:
3155 				/* L2T, broadcast */
3156 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
3157 					dev_warn_once(p->dev, "bad L2T, broadcast DMA_PACKET_COPY\n");
3158 					return -EINVAL;
3159 				}
3160 				r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3161 				if (r) {
3162 					dev_warn_once(p->dev, "bad L2T, broadcast DMA_PACKET_COPY\n");
3163 					return -EINVAL;
3164 				}
3165 				dst_offset = radeon_get_ib_value(p, idx+1);
3166 				dst_offset <<= 8;
3167 				dst2_offset = radeon_get_ib_value(p, idx+2);
3168 				dst2_offset <<= 8;
3169 				src_offset = radeon_get_ib_value(p, idx+8);
3170 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
3171 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3172 					dev_warn_once(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
3173 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3174 					return -EINVAL;
3175 				}
3176 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3177 					dev_warn_once(p->dev, "DMA L2T, broadcast dst buffer too small (%llu %lu)\n",
3178 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3179 					return -EINVAL;
3180 				}
3181 				if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3182 					dev_warn_once(p->dev, "DMA L2T, broadcast dst2 buffer too small (%llu %lu)\n",
3183 						      dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3184 					return -EINVAL;
3185 				}
3186 				ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3187 				ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
3188 				ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3189 				ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3190 				p->idx += 10;
3191 				break;
3192 			/* Copy L2T/T2L (tile units) */
3193 			case 0x4c:
3194 				/* L2T, T2L */
3195 				/* detile bit */
3196 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
3197 					/* tiled src, linear dst */
3198 					src_offset = radeon_get_ib_value(p, idx+1);
3199 					src_offset <<= 8;
3200 					ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
3201 
3202 					dst_offset = radeon_get_ib_value(p, idx+7);
3203 					dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3204 					ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
3205 					ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
3206 				} else {
3207 					/* linear src, tiled dst */
3208 					src_offset = radeon_get_ib_value(p, idx+7);
3209 					src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3210 					ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3211 					ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3212 
3213 					dst_offset = radeon_get_ib_value(p, idx+1);
3214 					dst_offset <<= 8;
3215 					ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3216 				}
3217 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3218 					dev_warn_once(p->dev, "DMA L2T, T2L src buffer too small (%llu %lu)\n",
3219 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3220 					return -EINVAL;
3221 				}
3222 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3223 					dev_warn_once(p->dev, "DMA L2T, T2L dst buffer too small (%llu %lu)\n",
3224 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3225 					return -EINVAL;
3226 				}
3227 				p->idx += 9;
3228 				break;
3229 			/* Copy T2T, partial (tile units) */
3230 			case 0x4d:
3231 				/* T2T partial */
3232 				if (p->family < CHIP_CAYMAN) {
3233 					dev_warn_once(p->dev, "L2T, T2L Partial is cayman only !\n");
3234 					return -EINVAL;
3235 				}
3236 				ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
3237 				ib[idx+4] += (u32)(dst_reloc->gpu_offset >> 8);
3238 				p->idx += 13;
3239 				break;
3240 			/* Copy L2T broadcast (tile units) */
3241 			case 0x4f:
3242 				/* L2T, broadcast */
3243 				if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
3244 					dev_warn_once(p->dev, "bad L2T, broadcast DMA_PACKET_COPY\n");
3245 					return -EINVAL;
3246 				}
3247 				r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3248 				if (r) {
3249 					dev_warn_once(p->dev, "bad L2T, broadcast DMA_PACKET_COPY\n");
3250 					return -EINVAL;
3251 				}
3252 				dst_offset = radeon_get_ib_value(p, idx+1);
3253 				dst_offset <<= 8;
3254 				dst2_offset = radeon_get_ib_value(p, idx+2);
3255 				dst2_offset <<= 8;
3256 				src_offset = radeon_get_ib_value(p, idx+8);
3257 				src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
3258 				if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3259 					dev_warn_once(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
3260 						      src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3261 					return -EINVAL;
3262 				}
3263 				if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3264 					dev_warn_once(p->dev, "DMA L2T, broadcast dst buffer too small (%llu %lu)\n",
3265 						      dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3266 					return -EINVAL;
3267 				}
3268 				if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3269 					dev_warn_once(p->dev, "DMA L2T, broadcast dst2 buffer too small (%llu %lu)\n",
3270 						      dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3271 					return -EINVAL;
3272 				}
3273 				ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
3274 				ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
3275 				ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
3276 				ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
3277 				p->idx += 10;
3278 				break;
3279 			default:
3280 				dev_warn_once(p->dev, "bad DMA_PACKET_COPY [%6d] 0x%08x invalid sub cmd\n", idx, header);
3281 				return -EINVAL;
3282 			}
3283 			break;
3284 		case DMA_PACKET_CONSTANT_FILL:
3285 			r = r600_dma_cs_next_reloc(p, &dst_reloc);
3286 			if (r) {
3287 				dev_warn_once(p->dev, "bad DMA_PACKET_CONSTANT_FILL\n");
3288 				return -EINVAL;
3289 			}
3290 			dst_offset = radeon_get_ib_value(p, idx+1);
3291 			dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
3292 			if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3293 				dev_warn_once(p->dev, "DMA constant fill buffer too small (%llu %lu)\n",
3294 					      dst_offset, radeon_bo_size(dst_reloc->robj));
3295 				return -EINVAL;
3296 			}
3297 			ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
3298 			ib[idx+3] += (upper_32_bits(dst_reloc->gpu_offset) << 16) & 0x00ff0000;
3299 			p->idx += 4;
3300 			break;
3301 		case DMA_PACKET_NOP:
3302 			p->idx += 1;
3303 			break;
3304 		default:
3305 			dev_warn_once(p->dev, "Unknown packet type %d at %d !\n", cmd, idx);
3306 			return -EINVAL;
3307 		}
3308 	} while (p->idx < p->chunk_ib->length_dw);
3309 #if 0
3310 	for (r = 0; r < p->ib->length_dw; r++) {
3311 		pr_info("%05d  0x%08X\n", r, p->ib.ptr[r]);
3312 		mdelay(1);
3313 	}
3314 #endif
3315 	return 0;
3316 }
3317 
3318 /* vm parser */
evergreen_vm_reg_valid(u32 reg)3319 static bool evergreen_vm_reg_valid(u32 reg)
3320 {
3321 	/* context regs are fine */
3322 	if (reg >= 0x28000)
3323 		return true;
3324 
3325 	/* check config regs */
3326 	switch (reg) {
3327 	case WAIT_UNTIL:
3328 	case GRBM_GFX_INDEX:
3329 	case CP_STRMOUT_CNTL:
3330 	case CP_COHER_CNTL:
3331 	case CP_COHER_SIZE:
3332 	case VGT_VTX_VECT_EJECT_REG:
3333 	case VGT_CACHE_INVALIDATION:
3334 	case VGT_GS_VERTEX_REUSE:
3335 	case VGT_PRIMITIVE_TYPE:
3336 	case VGT_INDEX_TYPE:
3337 	case VGT_NUM_INDICES:
3338 	case VGT_NUM_INSTANCES:
3339 	case VGT_COMPUTE_DIM_X:
3340 	case VGT_COMPUTE_DIM_Y:
3341 	case VGT_COMPUTE_DIM_Z:
3342 	case VGT_COMPUTE_START_X:
3343 	case VGT_COMPUTE_START_Y:
3344 	case VGT_COMPUTE_START_Z:
3345 	case VGT_COMPUTE_INDEX:
3346 	case VGT_COMPUTE_THREAD_GROUP_SIZE:
3347 	case VGT_HS_OFFCHIP_PARAM:
3348 	case PA_CL_ENHANCE:
3349 	case PA_SU_LINE_STIPPLE_VALUE:
3350 	case PA_SC_LINE_STIPPLE_STATE:
3351 	case PA_SC_ENHANCE:
3352 	case SQ_DYN_GPR_CNTL_PS_FLUSH_REQ:
3353 	case SQ_DYN_GPR_SIMD_LOCK_EN:
3354 	case SQ_CONFIG:
3355 	case SQ_GPR_RESOURCE_MGMT_1:
3356 	case SQ_GLOBAL_GPR_RESOURCE_MGMT_1:
3357 	case SQ_GLOBAL_GPR_RESOURCE_MGMT_2:
3358 	case SQ_CONST_MEM_BASE:
3359 	case SQ_STATIC_THREAD_MGMT_1:
3360 	case SQ_STATIC_THREAD_MGMT_2:
3361 	case SQ_STATIC_THREAD_MGMT_3:
3362 	case SPI_CONFIG_CNTL:
3363 	case SPI_CONFIG_CNTL_1:
3364 	case TA_CNTL_AUX:
3365 	case DB_DEBUG:
3366 	case DB_DEBUG2:
3367 	case DB_DEBUG3:
3368 	case DB_DEBUG4:
3369 	case DB_WATERMARKS:
3370 	case TD_PS_BORDER_COLOR_INDEX:
3371 	case TD_PS_BORDER_COLOR_RED:
3372 	case TD_PS_BORDER_COLOR_GREEN:
3373 	case TD_PS_BORDER_COLOR_BLUE:
3374 	case TD_PS_BORDER_COLOR_ALPHA:
3375 	case TD_VS_BORDER_COLOR_INDEX:
3376 	case TD_VS_BORDER_COLOR_RED:
3377 	case TD_VS_BORDER_COLOR_GREEN:
3378 	case TD_VS_BORDER_COLOR_BLUE:
3379 	case TD_VS_BORDER_COLOR_ALPHA:
3380 	case TD_GS_BORDER_COLOR_INDEX:
3381 	case TD_GS_BORDER_COLOR_RED:
3382 	case TD_GS_BORDER_COLOR_GREEN:
3383 	case TD_GS_BORDER_COLOR_BLUE:
3384 	case TD_GS_BORDER_COLOR_ALPHA:
3385 	case TD_HS_BORDER_COLOR_INDEX:
3386 	case TD_HS_BORDER_COLOR_RED:
3387 	case TD_HS_BORDER_COLOR_GREEN:
3388 	case TD_HS_BORDER_COLOR_BLUE:
3389 	case TD_HS_BORDER_COLOR_ALPHA:
3390 	case TD_LS_BORDER_COLOR_INDEX:
3391 	case TD_LS_BORDER_COLOR_RED:
3392 	case TD_LS_BORDER_COLOR_GREEN:
3393 	case TD_LS_BORDER_COLOR_BLUE:
3394 	case TD_LS_BORDER_COLOR_ALPHA:
3395 	case TD_CS_BORDER_COLOR_INDEX:
3396 	case TD_CS_BORDER_COLOR_RED:
3397 	case TD_CS_BORDER_COLOR_GREEN:
3398 	case TD_CS_BORDER_COLOR_BLUE:
3399 	case TD_CS_BORDER_COLOR_ALPHA:
3400 	case SQ_ESGS_RING_SIZE:
3401 	case SQ_GSVS_RING_SIZE:
3402 	case SQ_ESTMP_RING_SIZE:
3403 	case SQ_GSTMP_RING_SIZE:
3404 	case SQ_HSTMP_RING_SIZE:
3405 	case SQ_LSTMP_RING_SIZE:
3406 	case SQ_PSTMP_RING_SIZE:
3407 	case SQ_VSTMP_RING_SIZE:
3408 	case SQ_ESGS_RING_ITEMSIZE:
3409 	case SQ_ESTMP_RING_ITEMSIZE:
3410 	case SQ_GSTMP_RING_ITEMSIZE:
3411 	case SQ_GSVS_RING_ITEMSIZE:
3412 	case SQ_GS_VERT_ITEMSIZE:
3413 	case SQ_GS_VERT_ITEMSIZE_1:
3414 	case SQ_GS_VERT_ITEMSIZE_2:
3415 	case SQ_GS_VERT_ITEMSIZE_3:
3416 	case SQ_GSVS_RING_OFFSET_1:
3417 	case SQ_GSVS_RING_OFFSET_2:
3418 	case SQ_GSVS_RING_OFFSET_3:
3419 	case SQ_HSTMP_RING_ITEMSIZE:
3420 	case SQ_LSTMP_RING_ITEMSIZE:
3421 	case SQ_PSTMP_RING_ITEMSIZE:
3422 	case SQ_VSTMP_RING_ITEMSIZE:
3423 	case VGT_TF_RING_SIZE:
3424 	case SQ_ESGS_RING_BASE:
3425 	case SQ_GSVS_RING_BASE:
3426 	case SQ_ESTMP_RING_BASE:
3427 	case SQ_GSTMP_RING_BASE:
3428 	case SQ_HSTMP_RING_BASE:
3429 	case SQ_LSTMP_RING_BASE:
3430 	case SQ_PSTMP_RING_BASE:
3431 	case SQ_VSTMP_RING_BASE:
3432 	case CAYMAN_VGT_OFFCHIP_LDS_BASE:
3433 	case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS:
3434 		return true;
3435 	default:
3436 		DRM_DEBUG("Invalid register 0x%x in CS\n", reg);
3437 		return false;
3438 	}
3439 }
3440 
evergreen_vm_packet3_check(struct radeon_device * rdev,u32 * ib,struct radeon_cs_packet * pkt)3441 static int evergreen_vm_packet3_check(struct radeon_device *rdev,
3442 				      u32 *ib, struct radeon_cs_packet *pkt)
3443 {
3444 	u32 idx = pkt->idx + 1;
3445 	u32 idx_value = ib[idx];
3446 	u32 start_reg, end_reg, reg, i;
3447 	u32 command, info;
3448 
3449 	switch (pkt->opcode) {
3450 	case PACKET3_NOP:
3451 		break;
3452 	case PACKET3_SET_BASE:
3453 		if (idx_value != 1) {
3454 			dev_warn_once(rdev->dev, "bad SET_BASE");
3455 			return -EINVAL;
3456 		}
3457 		break;
3458 	case PACKET3_CLEAR_STATE:
3459 	case PACKET3_INDEX_BUFFER_SIZE:
3460 	case PACKET3_DISPATCH_DIRECT:
3461 	case PACKET3_DISPATCH_INDIRECT:
3462 	case PACKET3_MODE_CONTROL:
3463 	case PACKET3_SET_PREDICATION:
3464 	case PACKET3_COND_EXEC:
3465 	case PACKET3_PRED_EXEC:
3466 	case PACKET3_DRAW_INDIRECT:
3467 	case PACKET3_DRAW_INDEX_INDIRECT:
3468 	case PACKET3_INDEX_BASE:
3469 	case PACKET3_DRAW_INDEX_2:
3470 	case PACKET3_CONTEXT_CONTROL:
3471 	case PACKET3_DRAW_INDEX_OFFSET:
3472 	case PACKET3_INDEX_TYPE:
3473 	case PACKET3_DRAW_INDEX:
3474 	case PACKET3_DRAW_INDEX_AUTO:
3475 	case PACKET3_DRAW_INDEX_IMMD:
3476 	case PACKET3_NUM_INSTANCES:
3477 	case PACKET3_DRAW_INDEX_MULTI_AUTO:
3478 	case PACKET3_STRMOUT_BUFFER_UPDATE:
3479 	case PACKET3_DRAW_INDEX_OFFSET_2:
3480 	case PACKET3_DRAW_INDEX_MULTI_ELEMENT:
3481 	case PACKET3_MPEG_INDEX:
3482 	case PACKET3_WAIT_REG_MEM:
3483 	case PACKET3_MEM_WRITE:
3484 	case PACKET3_PFP_SYNC_ME:
3485 	case PACKET3_SURFACE_SYNC:
3486 	case PACKET3_EVENT_WRITE:
3487 	case PACKET3_EVENT_WRITE_EOP:
3488 	case PACKET3_EVENT_WRITE_EOS:
3489 	case PACKET3_SET_CONTEXT_REG:
3490 	case PACKET3_SET_BOOL_CONST:
3491 	case PACKET3_SET_LOOP_CONST:
3492 	case PACKET3_SET_RESOURCE:
3493 	case PACKET3_SET_SAMPLER:
3494 	case PACKET3_SET_CTL_CONST:
3495 	case PACKET3_SET_RESOURCE_OFFSET:
3496 	case PACKET3_SET_CONTEXT_REG_INDIRECT:
3497 	case PACKET3_SET_RESOURCE_INDIRECT:
3498 	case CAYMAN_PACKET3_DEALLOC_STATE:
3499 		break;
3500 	case PACKET3_COND_WRITE:
3501 		if (!(idx_value & 0x10)) {
3502 			reg = ib[idx + 1] * 4;
3503 			if (!evergreen_vm_reg_valid(reg))
3504 				return -EINVAL;
3505 		}
3506 		if (!(idx_value & 0x100)) {
3507 			reg = ib[idx + 5] * 4;
3508 			if (!evergreen_vm_reg_valid(reg))
3509 				return -EINVAL;
3510 		}
3511 		break;
3512 	case PACKET3_COPY_DW:
3513 		if (idx_value & 0x2) {
3514 			reg = ib[idx + 3] * 4;
3515 			if (!evergreen_vm_reg_valid(reg))
3516 				return -EINVAL;
3517 		}
3518 		break;
3519 	case PACKET3_SET_CONFIG_REG:
3520 		start_reg = (idx_value << 2) + PACKET3_SET_CONFIG_REG_START;
3521 		end_reg = 4 * pkt->count + start_reg - 4;
3522 		if ((start_reg < PACKET3_SET_CONFIG_REG_START) ||
3523 		    (start_reg >= PACKET3_SET_CONFIG_REG_END) ||
3524 		    (end_reg >= PACKET3_SET_CONFIG_REG_END)) {
3525 			dev_warn_once(rdev->dev, "bad PACKET3_SET_CONFIG_REG\n");
3526 			return -EINVAL;
3527 		}
3528 		for (i = 0; i < pkt->count; i++) {
3529 			reg = start_reg + (4 * i);
3530 			if (!evergreen_vm_reg_valid(reg))
3531 				return -EINVAL;
3532 		}
3533 		break;
3534 	case PACKET3_CP_DMA:
3535 		command = ib[idx + 4];
3536 		info = ib[idx + 1];
3537 		if ((((info & 0x60000000) >> 29) != 0) || /* src = GDS or DATA */
3538 		    (((info & 0x00300000) >> 20) != 0) || /* dst = GDS */
3539 		    ((((info & 0x00300000) >> 20) == 0) &&
3540 		     (command & PACKET3_CP_DMA_CMD_DAS)) || /* dst = register */
3541 		    ((((info & 0x60000000) >> 29) == 0) &&
3542 		     (command & PACKET3_CP_DMA_CMD_SAS))) { /* src = register */
3543 			/* non mem to mem copies requires dw aligned count */
3544 			if ((command & 0x1fffff) % 4) {
3545 				dev_warn_once(rdev->dev, "CP DMA command requires dw count alignment\n");
3546 				return -EINVAL;
3547 			}
3548 		}
3549 		if (command & PACKET3_CP_DMA_CMD_SAS) {
3550 			/* src address space is register */
3551 			if (((info & 0x60000000) >> 29) == 0) {
3552 				start_reg = idx_value << 2;
3553 				if (command & PACKET3_CP_DMA_CMD_SAIC) {
3554 					reg = start_reg;
3555 					if (!evergreen_vm_reg_valid(reg)) {
3556 						dev_warn_once(rdev->dev, "CP DMA Bad SRC register\n");
3557 						return -EINVAL;
3558 					}
3559 				} else {
3560 					for (i = 0; i < (command & 0x1fffff); i++) {
3561 						reg = start_reg + (4 * i);
3562 						if (!evergreen_vm_reg_valid(reg)) {
3563 							dev_warn_once(rdev->dev, "CP DMA Bad SRC register\n");
3564 							return -EINVAL;
3565 						}
3566 					}
3567 				}
3568 			}
3569 		}
3570 		if (command & PACKET3_CP_DMA_CMD_DAS) {
3571 			/* dst address space is register */
3572 			if (((info & 0x00300000) >> 20) == 0) {
3573 				start_reg = ib[idx + 2];
3574 				if (command & PACKET3_CP_DMA_CMD_DAIC) {
3575 					reg = start_reg;
3576 					if (!evergreen_vm_reg_valid(reg)) {
3577 						dev_warn_once(rdev->dev, "CP DMA Bad DST register\n");
3578 						return -EINVAL;
3579 					}
3580 				} else {
3581 					for (i = 0; i < (command & 0x1fffff); i++) {
3582 						reg = start_reg + (4 * i);
3583 						if (!evergreen_vm_reg_valid(reg)) {
3584 							dev_warn_once(rdev->dev, "CP DMA Bad DST register\n");
3585 							return -EINVAL;
3586 						}
3587 					}
3588 				}
3589 			}
3590 		}
3591 		break;
3592 	case PACKET3_SET_APPEND_CNT: {
3593 		uint32_t areg;
3594 		uint32_t allowed_reg_base;
3595 
3596 		if (pkt->count != 2) {
3597 			dev_warn_once(rdev->dev, "bad SET_APPEND_CNT (invalid count)\n");
3598 			return -EINVAL;
3599 		}
3600 
3601 		allowed_reg_base = GDS_APPEND_COUNT_0;
3602 		allowed_reg_base -= PACKET3_SET_CONTEXT_REG_START;
3603 		allowed_reg_base >>= 2;
3604 
3605 		areg = idx_value >> 16;
3606 		if (areg < allowed_reg_base || areg > (allowed_reg_base + 11)) {
3607 			dev_warn_once(rdev->dev, "forbidden register for append cnt 0x%08x at %d\n",
3608 				      areg, idx);
3609 			return -EINVAL;
3610 		}
3611 		break;
3612 	}
3613 	default:
3614 		return -EINVAL;
3615 	}
3616 	return 0;
3617 }
3618 
evergreen_ib_parse(struct radeon_device * rdev,struct radeon_ib * ib)3619 int evergreen_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
3620 {
3621 	int ret = 0;
3622 	u32 idx = 0;
3623 	struct radeon_cs_packet pkt;
3624 
3625 	do {
3626 		pkt.idx = idx;
3627 		pkt.type = RADEON_CP_PACKET_GET_TYPE(ib->ptr[idx]);
3628 		pkt.count = RADEON_CP_PACKET_GET_COUNT(ib->ptr[idx]);
3629 		pkt.one_reg_wr = 0;
3630 		switch (pkt.type) {
3631 		case RADEON_PACKET_TYPE0:
3632 			dev_err(rdev->dev, "Packet0 not allowed!\n");
3633 			ret = -EINVAL;
3634 			break;
3635 		case RADEON_PACKET_TYPE2:
3636 			idx += 1;
3637 			break;
3638 		case RADEON_PACKET_TYPE3:
3639 			pkt.opcode = RADEON_CP_PACKET3_GET_OPCODE(ib->ptr[idx]);
3640 			ret = evergreen_vm_packet3_check(rdev, ib->ptr, &pkt);
3641 			idx += pkt.count + 2;
3642 			break;
3643 		default:
3644 			dev_err(rdev->dev, "Unknown packet type %d !\n", pkt.type);
3645 			ret = -EINVAL;
3646 			break;
3647 		}
3648 		if (ret)
3649 			break;
3650 	} while (idx < ib->length_dw);
3651 
3652 	return ret;
3653 }
3654 
3655 /**
3656  * evergreen_dma_ib_parse() - parse the DMA IB for VM
3657  * @rdev: radeon_device pointer
3658  * @ib:	radeon_ib pointer
3659  *
3660  * Parses the DMA IB from the VM CS ioctl
3661  * checks for errors. (Cayman-SI)
3662  * Returns 0 for success and an error on failure.
3663  **/
evergreen_dma_ib_parse(struct radeon_device * rdev,struct radeon_ib * ib)3664 int evergreen_dma_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
3665 {
3666 	u32 idx = 0;
3667 	u32 header, cmd, count, sub_cmd;
3668 
3669 	do {
3670 		header = ib->ptr[idx];
3671 		cmd = GET_DMA_CMD(header);
3672 		count = GET_DMA_COUNT(header);
3673 		sub_cmd = GET_DMA_SUB_CMD(header);
3674 
3675 		switch (cmd) {
3676 		case DMA_PACKET_WRITE:
3677 			switch (sub_cmd) {
3678 			/* tiled */
3679 			case 8:
3680 				idx += count + 7;
3681 				break;
3682 			/* linear */
3683 			case 0:
3684 				idx += count + 3;
3685 				break;
3686 			default:
3687 				dev_warn_once(rdev->dev,
3688 					      "bad DMA_PACKET_WRITE [%6d] 0x%08x sub cmd is not 0 or 8\n",
3689 					      idx, ib->ptr[idx]);
3690 				return -EINVAL;
3691 			}
3692 			break;
3693 		case DMA_PACKET_COPY:
3694 			switch (sub_cmd) {
3695 			/* Copy L2L, DW aligned */
3696 			case 0x00:
3697 				idx += 5;
3698 				break;
3699 			/* Copy L2T/T2L */
3700 			case 0x08:
3701 				idx += 9;
3702 				break;
3703 			/* Copy L2L, byte aligned */
3704 			case 0x40:
3705 				idx += 5;
3706 				break;
3707 			/* Copy L2L, partial */
3708 			case 0x41:
3709 				idx += 9;
3710 				break;
3711 			/* Copy L2L, DW aligned, broadcast */
3712 			case 0x44:
3713 				idx += 7;
3714 				break;
3715 			/* Copy L2T Frame to Field */
3716 			case 0x48:
3717 				idx += 10;
3718 				break;
3719 			/* Copy L2T/T2L, partial */
3720 			case 0x49:
3721 				idx += 12;
3722 				break;
3723 			/* Copy L2T broadcast */
3724 			case 0x4b:
3725 				idx += 10;
3726 				break;
3727 			/* Copy L2T/T2L (tile units) */
3728 			case 0x4c:
3729 				idx += 9;
3730 				break;
3731 			/* Copy T2T, partial (tile units) */
3732 			case 0x4d:
3733 				idx += 13;
3734 				break;
3735 			/* Copy L2T broadcast (tile units) */
3736 			case 0x4f:
3737 				idx += 10;
3738 				break;
3739 			default:
3740 				dev_warn_once(rdev->dev,
3741 					      "bad DMA_PACKET_COPY [%6d] 0x%08x invalid sub cmd\n",
3742 					      idx, ib->ptr[idx]);
3743 				return -EINVAL;
3744 			}
3745 			break;
3746 		case DMA_PACKET_CONSTANT_FILL:
3747 			idx += 4;
3748 			break;
3749 		case DMA_PACKET_NOP:
3750 			idx += 1;
3751 			break;
3752 		default:
3753 			dev_warn_once(rdev->dev, "Unknown packet type %d at %d !\n", cmd, idx);
3754 			return -EINVAL;
3755 		}
3756 	} while (idx < ib->length_dw);
3757 
3758 	return 0;
3759 }
3760