SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/gpu/drm/radeon/r300_cmdbuf.c

   1 /* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
   2  *
   3  * Copyright (C) The Weather Channel, Inc.  2002.
   4  * Copyright (C) 2004 Nicolai Haehnle.
   5  * All Rights Reserved.
   6  *
   7  * The Weather Channel (TM) funded Tungsten Graphics to develop the
   8  * initial release of the Radeon 8500 driver under the XFree86 license.
   9  * This notice must be preserved.
  10  *
  11  * Permission is hereby granted, free of charge, to any person obtaining a
  12  * copy of this software and associated documentation files (the "Software"),
  13  * to deal in the Software without restriction, including without limitation
  14  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15  * and/or sell copies of the Software, and to permit persons to whom the
  16  * Software is furnished to do so, subject to the following conditions:
  17  *
  18  * The above copyright notice and this permission notice (including the next
  19  * paragraph) shall be included in all copies or substantial portions of the
  20  * Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  25  * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  28  * DEALINGS IN THE SOFTWARE.
  29  *
  30  * Authors:
  31  *    Nicolai Haehnle <prefect_@gmx.net>
  32  */
  33
  34 #include "drmP.h"
  35 #include "drm.h"
  36 #include "radeon_drm.h"
  37 #include "radeon_drv.h"
  38 #include "r300_reg.h"
  39
  40 #define R300_SIMULTANEOUS_CLIPRECTS             4
  41
  42 /* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
  43  */
  44 static const int r300_cliprect_cntl[4] = {
  45         0xAAAA,
  46         0xEEEE,
  47         0xFEFE,
  48         0xFFFE
  49 };
  50
  51 /**
  52  * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
  53  * buffer, starting with index n.
  54  */
  55 static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
  56                                drm_radeon_kcmd_buffer_t *cmdbuf, int n)
  57 {
  58         struct drm_clip_rect box;
  59         int nr;
  60         int i;
  61         RING_LOCALS;
  62
  63         nr = cmdbuf->nbox - n;
  64         if (nr > R300_SIMULTANEOUS_CLIPRECTS)
  65                 nr = R300_SIMULTANEOUS_CLIPRECTS;
  66
  67         DRM_DEBUG("%i cliprects\n", nr);
  68
  69         if (nr) {
  70                 BEGIN_RING(6 + nr * 2);
  71                 OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
  72
  73                 for (i = 0; i < nr; ++i) {
  74                         if (DRM_COPY_FROM_USER_UNCHECKED
  75                             (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
  76                                 DRM_ERROR("copy cliprect faulted\n");
  77                                 return -EFAULT;
  78                         }
  79
  80                         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
  81                                 box.x1 = (box.x1) &
  82                                         R300_CLIPRECT_MASK;
  83                                 box.y1 = (box.y1) &
  84                                         R300_CLIPRECT_MASK;
  85                                 box.x2 = (box.x2) &
  86                                         R300_CLIPRECT_MASK;
  87                                 box.y2 = (box.y2) &
  88                                         R300_CLIPRECT_MASK;
  89                         } else {
  90                                 box.x1 = (box.x1 + R300_CLIPRECT_OFFSET) &
  91                                         R300_CLIPRECT_MASK;
  92                                 box.y1 = (box.y1 + R300_CLIPRECT_OFFSET) &
  93                                         R300_CLIPRECT_MASK;
  94                                 box.x2 = (box.x2 + R300_CLIPRECT_OFFSET) &
  95                                         R300_CLIPRECT_MASK;
  96                                 box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) &
  97                                         R300_CLIPRECT_MASK;
  98
  99                         }
 100                         OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
 101                                  (box.y1 << R300_CLIPRECT_Y_SHIFT));
 102                         OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
 103                                  (box.y2 << R300_CLIPRECT_Y_SHIFT));
 104
 105                 }
 106
 107                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr - 1]);
 108
 109                 /* TODO/SECURITY: Force scissors to a safe value, otherwise the
 110                  * client might be able to trample over memory.
 111                  * The impact should be very limited, but I'd rather be safe than
 112                  * sorry.
 113                  */
 114                 OUT_RING(CP_PACKET0(R300_RE_SCISSORS_TL, 1));
 115                 OUT_RING(0);
 116                 OUT_RING(R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK);
 117                 ADVANCE_RING();
 118         } else {
 119                 /* Why we allow zero cliprect rendering:
 120                  * There are some commands in a command buffer that must be submitted
 121                  * even when there are no cliprects, e.g. DMA buffer discard
 122                  * or state setting (though state setting could be avoided by
 123                  * simulating a loss of context).
 124                  *
 125                  * Now since the cmdbuf interface is so chaotic right now (and is
 126                  * bound to remain that way for a bit until things settle down),
 127                  * it is basically impossible to filter out the commands that are
 128                  * necessary and those that aren't.
 129                  *
 130                  * So I choose the safe way and don't do any filtering at all;
 131                  * instead, I simply set up the engine so that all rendering
 132                  * can't produce any fragments.
 133                  */
 134                 BEGIN_RING(2);
 135                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, 0);
 136                 ADVANCE_RING();
 137         }
 138
 139         /* flus cache and wait idle clean after cliprect change */
 140         BEGIN_RING(2);
 141         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 142         OUT_RING(R300_RB3D_DC_FLUSH);
 143         ADVANCE_RING();
 144         BEGIN_RING(2);
 145         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 146         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 147         ADVANCE_RING();
 148         /* set flush flag */
 149         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 150
 151         return 0;
 152 }
 153
 154 static u8 r300_reg_flags[0x10000 >> 2];
 155
 156 void r300_init_reg_flags(struct drm_device *dev)
 157 {
 158         int i;
 159         drm_radeon_private_t *dev_priv = dev->dev_private;
 160
 161         memset(r300_reg_flags, 0, 0x10000 >> 2);
 162 #define ADD_RANGE_MARK(reg, count,mark) \
 163                 for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
 164                         r300_reg_flags[i]|=(mark);
 165
 166 #define MARK_SAFE               1
 167 #define MARK_CHECK_OFFSET       2
 168
 169 #define ADD_RANGE(reg, count)   ADD_RANGE_MARK(reg, count, MARK_SAFE)
 170
 171         /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
 172         ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
 173         ADD_RANGE(R300_VAP_CNTL, 1);
 174         ADD_RANGE(R300_SE_VTE_CNTL, 2);
 175         ADD_RANGE(0x2134, 2);
 176         ADD_RANGE(R300_VAP_CNTL_STATUS, 1);
 177         ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
 178         ADD_RANGE(0x21DC, 1);
 179         ADD_RANGE(R300_VAP_UNKNOWN_221C, 1);
 180         ADD_RANGE(R300_VAP_CLIP_X_0, 4);
 181         ADD_RANGE(R300_VAP_PVS_STATE_FLUSH_REG, 1);
 182         ADD_RANGE(R300_VAP_UNKNOWN_2288, 1);
 183         ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
 184         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
 185         ADD_RANGE(R300_GB_ENABLE, 1);
 186         ADD_RANGE(R300_GB_MSPOS0, 5);
 187         ADD_RANGE(R300_TX_INVALTAGS, 1);
 188         ADD_RANGE(R300_TX_ENABLE, 1);
 189         ADD_RANGE(0x4200, 4);
 190         ADD_RANGE(0x4214, 1);
 191         ADD_RANGE(R300_RE_POINTSIZE, 1);
 192         ADD_RANGE(0x4230, 3);
 193         ADD_RANGE(R300_RE_LINE_CNT, 1);
 194         ADD_RANGE(R300_RE_UNK4238, 1);
 195         ADD_RANGE(0x4260, 3);
 196         ADD_RANGE(R300_RE_SHADE, 4);
 197         ADD_RANGE(R300_RE_POLYGON_MODE, 5);
 198         ADD_RANGE(R300_RE_ZBIAS_CNTL, 1);
 199         ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
 200         ADD_RANGE(R300_RE_OCCLUSION_CNTL, 1);
 201         ADD_RANGE(R300_RE_CULL_CNTL, 1);
 202         ADD_RANGE(0x42C0, 2);
 203         ADD_RANGE(R300_RS_CNTL_0, 2);
 204
 205         ADD_RANGE(R300_SC_HYPERZ, 2);
 206         ADD_RANGE(0x43E8, 1);
 207
 208         ADD_RANGE(0x46A4, 5);
 209
 210         ADD_RANGE(R300_RE_FOG_STATE, 1);
 211         ADD_RANGE(R300_FOG_COLOR_R, 3);
 212         ADD_RANGE(R300_PP_ALPHA_TEST, 2);
 213         ADD_RANGE(0x4BD8, 1);
 214         ADD_RANGE(R300_PFS_PARAM_0_X, 64);
 215         ADD_RANGE(0x4E00, 1);
 216         ADD_RANGE(R300_RB3D_CBLEND, 2);
 217         ADD_RANGE(R300_RB3D_COLORMASK, 1);
 218         ADD_RANGE(R300_RB3D_BLEND_COLOR, 3);
 219         ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET);   /* check offset */
 220         ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
 221         ADD_RANGE(0x4E50, 9);
 222         ADD_RANGE(0x4E88, 1);
 223         ADD_RANGE(0x4EA0, 2);
 224         ADD_RANGE(R300_ZB_CNTL, 3);
 225         ADD_RANGE(R300_ZB_FORMAT, 4);
 226         ADD_RANGE_MARK(R300_ZB_DEPTHOFFSET, 1, MARK_CHECK_OFFSET);      /* check offset */
 227         ADD_RANGE(R300_ZB_DEPTHPITCH, 1);
 228         ADD_RANGE(R300_ZB_DEPTHCLEARVALUE, 1);
 229         ADD_RANGE(R300_ZB_ZMASK_OFFSET, 13);
 230
 231         ADD_RANGE(R300_TX_FILTER_0, 16);
 232         ADD_RANGE(R300_TX_FILTER1_0, 16);
 233         ADD_RANGE(R300_TX_SIZE_0, 16);
 234         ADD_RANGE(R300_TX_FORMAT_0, 16);
 235         ADD_RANGE(R300_TX_PITCH_0, 16);
 236         /* Texture offset is dangerous and needs more checking */
 237         ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
 238         ADD_RANGE(R300_TX_CHROMA_KEY_0, 16);
 239         ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
 240
 241         /* Sporadic registers used as primitives are emitted */
 242         ADD_RANGE(R300_ZB_ZCACHE_CTLSTAT, 1);
 243         ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
 244         ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
 245         ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
 246
 247         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
 248                 ADD_RANGE(R500_VAP_INDEX_OFFSET, 1);
 249                 ADD_RANGE(R500_US_CONFIG, 2);
 250                 ADD_RANGE(R500_US_CODE_ADDR, 3);
 251                 ADD_RANGE(R500_US_FC_CTRL, 1);
 252                 ADD_RANGE(R500_RS_IP_0, 16);
 253                 ADD_RANGE(R500_RS_INST_0, 16);
 254                 ADD_RANGE(R500_RB3D_COLOR_CLEAR_VALUE_AR, 2);
 255                 ADD_RANGE(R500_RB3D_CONSTANT_COLOR_AR, 2);
 256                 ADD_RANGE(R500_ZB_FIFO_SIZE, 2);
 257         } else {
 258                 ADD_RANGE(R300_PFS_CNTL_0, 3);
 259                 ADD_RANGE(R300_PFS_NODE_0, 4);
 260                 ADD_RANGE(R300_PFS_TEXI_0, 64);
 261                 ADD_RANGE(R300_PFS_INSTR0_0, 64);
 262                 ADD_RANGE(R300_PFS_INSTR1_0, 64);
 263                 ADD_RANGE(R300_PFS_INSTR2_0, 64);
 264                 ADD_RANGE(R300_PFS_INSTR3_0, 64);
 265                 ADD_RANGE(R300_RS_INTERP_0, 8);
 266                 ADD_RANGE(R300_RS_ROUTE_0, 8);
 267
 268         }
 269 }
 270
 271 static __inline__ int r300_check_range(unsigned reg, int count)
 272 {
 273         int i;
 274         if (reg & ~0xffff)
 275                 return -1;
 276         for (i = (reg >> 2); i < (reg >> 2) + count; i++)
 277                 if (r300_reg_flags[i] != MARK_SAFE)
 278                         return 1;
 279         return 0;
 280 }
 281
 282 static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
 283                                                           dev_priv,
 284                                                           drm_radeon_kcmd_buffer_t
 285                                                           * cmdbuf,
 286                                                           drm_r300_cmd_header_t
 287                                                           header)
 288 {
 289         int reg;
 290         int sz;
 291         int i;
 292         int values[64];
 293         RING_LOCALS;
 294
 295         sz = header.packet0.count;
 296         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 297
 298         if ((sz > 64) || (sz < 0)) {
 299                 DRM_ERROR
 300                     ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
 301                      reg, sz);
 302                 return -EINVAL;
 303         }
 304         for (i = 0; i < sz; i++) {
 305                 values[i] = ((int *)cmdbuf->buf)[i];
 306                 switch (r300_reg_flags[(reg >> 2) + i]) {
 307                 case MARK_SAFE:
 308                         break;
 309                 case MARK_CHECK_OFFSET:
 310                         if (!radeon_check_offset(dev_priv, (u32) values[i])) {
 311                                 DRM_ERROR
 312                                     ("Offset failed range check (reg=%04x sz=%d)\n",
 313                                      reg, sz);
 314                                 return -EINVAL;
 315                         }
 316                         break;
 317                 default:
 318                         DRM_ERROR("Register %04x failed check as flag=%02x\n",
 319                                   reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
 320                         return -EINVAL;
 321                 }
 322         }
 323
 324         BEGIN_RING(1 + sz);
 325         OUT_RING(CP_PACKET0(reg, sz - 1));
 326         OUT_RING_TABLE(values, sz);
 327         ADVANCE_RING();
 328
 329         cmdbuf->buf += sz * 4;
 330         cmdbuf->bufsz -= sz * 4;
 331
 332         return 0;
 333 }
 334
 335 /**
 336  * Emits a packet0 setting arbitrary registers.
 337  * Called by r300_do_cp_cmdbuf.
 338  *
 339  * Note that checks are performed on contents and addresses of the registers
 340  */
 341 static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
 342                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 343                                         drm_r300_cmd_header_t header)
 344 {
 345         int reg;
 346         int sz;
 347         RING_LOCALS;
 348
 349         sz = header.packet0.count;
 350         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 351
 352         if (!sz)
 353                 return 0;
 354
 355         if (sz * 4 > cmdbuf->bufsz)
 356                 return -EINVAL;
 357
 358         if (reg + sz * 4 >= 0x10000) {
 359                 DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg,
 360                           sz);
 361                 return -EINVAL;
 362         }
 363
 364         if (r300_check_range(reg, sz)) {
 365                 /* go and check everything */
 366                 return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf,
 367                                                            header);
 368         }
 369         /* the rest of the data is safe to emit, whatever the values the user passed */
 370
 371         BEGIN_RING(1 + sz);
 372         OUT_RING(CP_PACKET0(reg, sz - 1));
 373         OUT_RING_TABLE((int *)cmdbuf->buf, sz);
 374         ADVANCE_RING();
 375
 376         cmdbuf->buf += sz * 4;
 377         cmdbuf->bufsz -= sz * 4;
 378
 379         return 0;
 380 }
 381
 382 /**
 383  * Uploads user-supplied vertex program instructions or parameters onto
 384  * the graphics card.
 385  * Called by r300_do_cp_cmdbuf.
 386  */
 387 static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
 388                                     drm_radeon_kcmd_buffer_t *cmdbuf,
 389                                     drm_r300_cmd_header_t header)
 390 {
 391         int sz;
 392         int addr;
 393         RING_LOCALS;
 394
 395         sz = header.vpu.count;
 396         addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
 397
 398         if (!sz)
 399                 return 0;
 400         if (sz * 16 > cmdbuf->bufsz)
 401                 return -EINVAL;
 402
 403         /* VAP is very sensitive so we purge cache before we program it
 404          * and we also flush its state before & after */
 405         BEGIN_RING(6);
 406         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 407         OUT_RING(R300_RB3D_DC_FLUSH);
 408         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 409         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 410         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 411         OUT_RING(0);
 412         ADVANCE_RING();
 413         /* set flush flag */
 414         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 415
 416         BEGIN_RING(3 + sz * 4);
 417         OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
 418         OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
 419         OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4);
 420         ADVANCE_RING();
 421
 422         BEGIN_RING(2);
 423         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 424         OUT_RING(0);
 425         ADVANCE_RING();
 426
 427         cmdbuf->buf += sz * 16;
 428         cmdbuf->bufsz -= sz * 16;
 429
 430         return 0;
 431 }
 432
 433 /**
 434  * Emit a clear packet from userspace.
 435  * Called by r300_emit_packet3.
 436  */
 437 static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
 438                                       drm_radeon_kcmd_buffer_t *cmdbuf)
 439 {
 440         RING_LOCALS;
 441
 442         if (8 * 4 > cmdbuf->bufsz)
 443                 return -EINVAL;
 444
 445         BEGIN_RING(10);
 446         OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8));
 447         OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING |
 448                  (1 << R300_PRIM_NUM_VERTICES_SHIFT));
 449         OUT_RING_TABLE((int *)cmdbuf->buf, 8);
 450         ADVANCE_RING();
 451
 452         BEGIN_RING(4);
 453         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 454         OUT_RING(R300_RB3D_DC_FLUSH);
 455         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 456         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 457         ADVANCE_RING();
 458         /* set flush flag */
 459         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 460
 461         cmdbuf->buf += 8 * 4;
 462         cmdbuf->bufsz -= 8 * 4;
 463
 464         return 0;
 465 }
 466
 467 static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 468                                                drm_radeon_kcmd_buffer_t *cmdbuf,
 469                                                u32 header)
 470 {
 471         int count, i, k;
 472 #define MAX_ARRAY_PACKET  64
 473         u32 payload[MAX_ARRAY_PACKET];
 474         u32 narrays;
 475         RING_LOCALS;
 476
 477         count = (header >> 16) & 0x3fff;
 478
 479         if ((count + 1) > MAX_ARRAY_PACKET) {
 480                 DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
 481                           count);
 482                 return -EINVAL;
 483         }
 484         memset(payload, 0, MAX_ARRAY_PACKET * 4);
 485         memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);
 486
 487         /* carefully check packet contents */
 488
 489         narrays = payload[0];
 490         k = 0;
 491         i = 1;
 492         while ((k < narrays) && (i < (count + 1))) {
 493                 i++;            /* skip attribute field */
 494                 if (!radeon_check_offset(dev_priv, payload[i])) {
 495                         DRM_ERROR
 496                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 497                              k, i);
 498                         return -EINVAL;
 499                 }
 500                 k++;
 501                 i++;
 502                 if (k == narrays)
 503                         break;
 504                 /* have one more to process, they come in pairs */
 505                 if (!radeon_check_offset(dev_priv, payload[i])) {
 506                         DRM_ERROR
 507                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 508                              k, i);
 509                         return -EINVAL;
 510                 }
 511                 k++;
 512                 i++;
 513         }
 514         /* do the counts match what we expect ? */
 515         if ((k != narrays) || (i != (count + 1))) {
 516                 DRM_ERROR
 517                     ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",
 518                      k, i, narrays, count + 1);
 519                 return -EINVAL;
 520         }
 521
 522         /* all clear, output packet */
 523
 524         BEGIN_RING(count + 2);
 525         OUT_RING(header);
 526         OUT_RING_TABLE(payload, count + 1);
 527         ADVANCE_RING();
 528
 529         cmdbuf->buf += (count + 2) * 4;
 530         cmdbuf->bufsz -= (count + 2) * 4;
 531
 532         return 0;
 533 }
 534
 535 static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
 536                                              drm_radeon_kcmd_buffer_t *cmdbuf)
 537 {
 538         u32 *cmd = (u32 *) cmdbuf->buf;
 539         int count, ret;
 540         RING_LOCALS;
 541
 542         count=(cmd[0]>>16) & 0x3fff;
 543
 544         if (cmd[0] & 0x8000) {
 545                 u32 offset;
 546
 547                 if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
 548                               | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 549                         offset = cmd[2] << 10;
 550                         ret = !radeon_check_offset(dev_priv, offset);
 551                         if (ret) {
 552                                 DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
 553                                 return -EINVAL;
 554                         }
 555                 }
 556
 557                 if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
 558                     (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 559                         offset = cmd[3] << 10;
 560                         ret = !radeon_check_offset(dev_priv, offset);
 561                         if (ret) {
 562                                 DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
 563                                 return -EINVAL;
 564                         }
 565
 566                 }
 567         }
 568
 569         BEGIN_RING(count+2);
 570         OUT_RING(cmd[0]);
 571         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 572         ADVANCE_RING();
 573
 574         cmdbuf->buf += (count+2)*4;
 575         cmdbuf->bufsz -= (count+2)*4;
 576
 577         return 0;
 578 }
 579
 580 static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
 581                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 582 {
 583         u32 *cmd;
 584         int count;
 585         int expected_count;
 586         RING_LOCALS;
 587
 588         cmd = (u32 *) cmdbuf->buf;
 589         count = (cmd[0]>>16) & 0x3fff;
 590         expected_count = cmd[1] >> 16;
 591         if (!(cmd[1] & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
 592                 expected_count = (expected_count+1)/2;
 593
 594         if (count && count != expected_count) {
 595                 DRM_ERROR("3D_DRAW_INDX_2: packet size %i, expected %i\n",
 596                         count, expected_count);
 597                 return -EINVAL;
 598         }
 599
 600         BEGIN_RING(count+2);
 601         OUT_RING(cmd[0]);
 602         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 603         ADVANCE_RING();
 604
 605         cmdbuf->buf += (count+2)*4;
 606         cmdbuf->bufsz -= (count+2)*4;
 607
 608         if (!count) {
 609                 drm_r300_cmd_header_t header;
 610
 611                 if (cmdbuf->bufsz < 4*4 + sizeof(header)) {
 612                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER, but stream is too short.\n");
 613                         return -EINVAL;
 614                 }
 615
 616                 header.u = *(unsigned int *)cmdbuf->buf;
 617
 618                 cmdbuf->buf += sizeof(header);
 619                 cmdbuf->bufsz -= sizeof(header);
 620                 cmd = (u32 *) cmdbuf->buf;
 621
 622                 if (header.header.cmd_type != R300_CMD_PACKET3 ||
 623                     header.packet3.packet != R300_CMD_PACKET3_RAW ||
 624                     cmd[0] != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
 625                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER.\n");
 626                         return -EINVAL;
 627                 }
 628
 629                 if ((cmd[1] & 0x8000ffff) != 0x80000810) {
 630                         DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
 631                         return -EINVAL;
 632                 }
 633                 if (!radeon_check_offset(dev_priv, cmd[2])) {
 634                         DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
 635                         return -EINVAL;
 636                 }
 637                 if (cmd[3] != expected_count) {
 638                         DRM_ERROR("INDX_BUFFER: buffer size %i, expected %i\n",
 639                                 cmd[3], expected_count);
 640                         return -EINVAL;
 641                 }
 642
 643                 BEGIN_RING(4);
 644                 OUT_RING(cmd[0]);
 645                 OUT_RING_TABLE((int *)(cmdbuf->buf + 4), 3);
 646                 ADVANCE_RING();
 647
 648                 cmdbuf->buf += 4*4;
 649                 cmdbuf->bufsz -= 4*4;
 650         }
 651
 652         return 0;
 653 }
 654
 655 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
 656                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 657 {
 658         u32 header;
 659         int count;
 660         RING_LOCALS;
 661
 662         if (4 > cmdbuf->bufsz)
 663                 return -EINVAL;
 664
 665         /* Fixme !! This simply emits a packet without much checking.
 666            We need to be smarter. */
 667
 668         /* obtain first word - actual packet3 header */
 669         header = *(u32 *) cmdbuf->buf;
 670
 671         /* Is it packet 3 ? */
 672         if ((header >> 30) != 0x3) {
 673                 DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
 674                 return -EINVAL;
 675         }
 676
 677         count = (header >> 16) & 0x3fff;
 678
 679         /* Check again now that we know how much data to expect */
 680         if ((count + 2) * 4 > cmdbuf->bufsz) {
 681                 DRM_ERROR
 682                     ("Expected packet3 of length %d but have only %d bytes left\n",
 683                      (count + 2) * 4, cmdbuf->bufsz);
 684                 return -EINVAL;
 685         }
 686
 687         /* Is it a packet type we know about ? */
 688         switch (header & 0xff00) {
 689         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
 690                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 691
 692         case RADEON_CNTL_BITBLT_MULTI:
 693                 return r300_emit_bitblt_multi(dev_priv, cmdbuf);
 694
 695         case RADEON_CP_INDX_BUFFER:
 696                 DRM_ERROR("packet3 INDX_BUFFER without preceding 3D_DRAW_INDX_2 is illegal.\n");
 697                 return -EINVAL;
 698         case RADEON_CP_3D_DRAW_IMMD_2:
 699                 /* triggers drawing using in-packet vertex data */
 700         case RADEON_CP_3D_DRAW_VBUF_2:
 701                 /* triggers drawing of vertex buffers setup elsewhere */
 702                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 703                                            RADEON_PURGE_EMITED);
 704                 break;
 705         case RADEON_CP_3D_DRAW_INDX_2:
 706                 /* triggers drawing using indices to vertex buffer */
 707                 /* whenever we send vertex we clear flush & purge */
 708                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 709                                            RADEON_PURGE_EMITED);
 710                 return r300_emit_draw_indx_2(dev_priv, cmdbuf);
 711         case RADEON_WAIT_FOR_IDLE:
 712         case RADEON_CP_NOP:
 713                 /* these packets are safe */
 714                 break;
 715         default:
 716                 DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
 717                 return -EINVAL;
 718         }
 719
 720         BEGIN_RING(count + 2);
 721         OUT_RING(header);
 722         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 723         ADVANCE_RING();
 724
 725         cmdbuf->buf += (count + 2) * 4;
 726         cmdbuf->bufsz -= (count + 2) * 4;
 727
 728         return 0;
 729 }
 730
 731 /**
 732  * Emit a rendering packet3 from userspace.
 733  * Called by r300_do_cp_cmdbuf.
 734  */
 735 static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
 736                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 737                                         drm_r300_cmd_header_t header)
 738 {
 739         int n;
 740         int ret;
 741         char *orig_buf = cmdbuf->buf;
 742         int orig_bufsz = cmdbuf->bufsz;
 743
 744         /* This is a do-while-loop so that we run the interior at least once,
 745          * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
 746          */
 747         n = 0;
 748         do {
 749                 if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
 750                         ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
 751                         if (ret)
 752                                 return ret;
 753
 754                         cmdbuf->buf = orig_buf;
 755                         cmdbuf->bufsz = orig_bufsz;
 756                 }
 757
 758                 switch (header.packet3.packet) {
 759                 case R300_CMD_PACKET3_CLEAR:
 760                         DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
 761                         ret = r300_emit_clear(dev_priv, cmdbuf);
 762                         if (ret) {
 763                                 DRM_ERROR("r300_emit_clear failed\n");
 764                                 return ret;
 765                         }
 766                         break;
 767
 768                 case R300_CMD_PACKET3_RAW:
 769                         DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
 770                         ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
 771                         if (ret) {
 772                                 DRM_ERROR("r300_emit_raw_packet3 failed\n");
 773                                 return ret;
 774                         }
 775                         break;
 776
 777                 default:
 778                         DRM_ERROR("bad packet3 type %i at %p\n",
 779                                   header.packet3.packet,
 780                                   cmdbuf->buf - sizeof(header));
 781                         return -EINVAL;
 782                 }
 783
 784                 n += R300_SIMULTANEOUS_CLIPRECTS;
 785         } while (n < cmdbuf->nbox);
 786
 787         return 0;
 788 }
 789
 790 /* Some of the R300 chips seem to be extremely touchy about the two registers
 791  * that are configured in r300_pacify.
 792  * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
 793  * sends a command buffer that contains only state setting commands and a
 794  * vertex program/parameter upload sequence, this will eventually lead to a
 795  * lockup, unless the sequence is bracketed by calls to r300_pacify.
 796  * So we should take great care to *always* call r300_pacify before
 797  * *anything* 3D related, and again afterwards. This is what the
 798  * call bracket in r300_do_cp_cmdbuf is for.
 799  */
 800
 801 /**
 802  * Emit the sequence to pacify R300.
 803  */
 804 static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv)
 805 {
 806         uint32_t cache_z, cache_3d, cache_2d;
 807         RING_LOCALS;
 808
 809         cache_z = R300_ZC_FLUSH;
 810         cache_2d = R300_RB2D_DC_FLUSH;
 811         cache_3d = R300_RB3D_DC_FLUSH;
 812         if (!(dev_priv->track_flush & RADEON_PURGE_EMITED)) {
 813                 /* we can purge, primitive where draw since last purge */
 814                 cache_z |= R300_ZC_FREE;
 815                 cache_2d |= R300_RB2D_DC_FREE;
 816                 cache_3d |= R300_RB3D_DC_FREE;
 817         }
 818
 819         /* flush & purge zbuffer */
 820         BEGIN_RING(2);
 821         OUT_RING(CP_PACKET0(R300_ZB_ZCACHE_CTLSTAT, 0));
 822         OUT_RING(cache_z);
 823         ADVANCE_RING();
 824         /* flush & purge 3d */
 825         BEGIN_RING(2);
 826         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 827         OUT_RING(cache_3d);
 828         ADVANCE_RING();
 829         /* flush & purge texture */
 830         BEGIN_RING(2);
 831         OUT_RING(CP_PACKET0(R300_TX_INVALTAGS, 0));
 832         OUT_RING(0);
 833         ADVANCE_RING();
 834         /* FIXME: is this one really needed ? */
 835         BEGIN_RING(2);
 836         OUT_RING(CP_PACKET0(R300_RB3D_AARESOLVE_CTL, 0));
 837         OUT_RING(0);
 838         ADVANCE_RING();
 839         BEGIN_RING(2);
 840         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 841         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 842         ADVANCE_RING();
 843         /* flush & purge 2d through E2 as RB2D will trigger lockup */
 844         BEGIN_RING(4);
 845         OUT_RING(CP_PACKET0(R300_DSTCACHE_CTLSTAT, 0));
 846         OUT_RING(cache_2d);
 847         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 848         OUT_RING(RADEON_WAIT_2D_IDLECLEAN |
 849                  RADEON_WAIT_HOST_IDLECLEAN);
 850         ADVANCE_RING();
 851         /* set flush & purge flags */
 852         dev_priv->track_flush |= RADEON_FLUSH_EMITED | RADEON_PURGE_EMITED;
 853 }
 854
 855 /**
 856  * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
 857  * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
 858  * be careful about how this function is called.
 859  */
 860 static void r300_discard_buffer(struct drm_device * dev, struct drm_buf * buf)
 861 {
 862         drm_radeon_private_t *dev_priv = dev->dev_private;
 863         drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
 864
 865         buf_priv->age = ++dev_priv->sarea_priv->last_dispatch;
 866         buf->pending = 1;
 867         buf->used = 0;
 868 }
 869
 870 static void r300_cmd_wait(drm_radeon_private_t * dev_priv,
 871                           drm_r300_cmd_header_t header)
 872 {
 873         u32 wait_until;
 874         RING_LOCALS;
 875
 876         if (!header.wait.flags)
 877                 return;
 878
 879         wait_until = 0;
 880
 881         switch(header.wait.flags) {
 882         case R300_WAIT_2D:
 883                 wait_until = RADEON_WAIT_2D_IDLE;
 884                 break;
 885         case R300_WAIT_3D:
 886                 wait_until = RADEON_WAIT_3D_IDLE;
 887                 break;
 888         case R300_NEW_WAIT_2D_3D:
 889                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_3D_IDLE;
 890                 break;
 891         case R300_NEW_WAIT_2D_2D_CLEAN:
 892                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 893                 break;
 894         case R300_NEW_WAIT_3D_3D_CLEAN:
 895                 wait_until = RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 896                 break;
 897         case R300_NEW_WAIT_2D_2D_CLEAN_3D_3D_CLEAN:
 898                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 899                 wait_until |= RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 900                 break;
 901         default:
 902                 return;
 903         }
 904
 905         BEGIN_RING(2);
 906         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 907         OUT_RING(wait_until);
 908         ADVANCE_RING();
 909 }
 910
 911 static int r300_scratch(drm_radeon_private_t *dev_priv,
 912                         drm_radeon_kcmd_buffer_t *cmdbuf,
 913                         drm_r300_cmd_header_t header)
 914 {
 915         u32 *ref_age_base;
 916         u32 i, buf_idx, h_pending;
 917         RING_LOCALS;
 918
 919         if (cmdbuf->bufsz <
 920             (sizeof(u64) + header.scratch.n_bufs * sizeof(buf_idx))) {
 921                 return -EINVAL;
 922         }
 923
 924         if (header.scratch.reg >= 5) {
 925                 return -EINVAL;
 926         }
 927
 928         dev_priv->scratch_ages[header.scratch.reg]++;
 929
 930         ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
 931
 932         cmdbuf->buf += sizeof(u64);
 933         cmdbuf->bufsz -= sizeof(u64);
 934
 935         for (i=0; i < header.scratch.n_bufs; i++) {
 936                 buf_idx = *(u32 *)cmdbuf->buf;
 937                 buf_idx *= 2; /* 8 bytes per buf */
 938
 939                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
 940                         return -EINVAL;
 941                 }
 942
 943                 if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + buf_idx + 1, sizeof(u32))) {
 944                         return -EINVAL;
 945                 }
 946
 947                 if (h_pending == 0) {
 948                         return -EINVAL;
 949                 }
 950
 951                 h_pending--;
 952
 953                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx + 1, &h_pending, sizeof(u32))) {
 954                         return -EINVAL;
 955                 }
 956
 957                 cmdbuf->buf += sizeof(buf_idx);
 958                 cmdbuf->bufsz -= sizeof(buf_idx);
 959         }
 960
 961         BEGIN_RING(2);
 962         OUT_RING( CP_PACKET0( RADEON_SCRATCH_REG0 + header.scratch.reg * 4, 0 ) );
 963         OUT_RING( dev_priv->scratch_ages[header.scratch.reg] );
 964         ADVANCE_RING();
 965
 966         return 0;
 967 }
 968
 969 /**
 970  * Uploads user-supplied vertex program instructions or parameters onto
 971  * the graphics card.
 972  * Called by r300_do_cp_cmdbuf.
 973  */
 974 static inline int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
 975                                        drm_radeon_kcmd_buffer_t *cmdbuf,
 976                                        drm_r300_cmd_header_t header)
 977 {
 978         int sz;
 979         int addr;
 980         int type;
 981         int clamp;
 982         int stride;
 983         RING_LOCALS;
 984
 985         sz = header.r500fp.count;
 986         /* address is 9 bits 0 - 8, bit 1 of flags is part of address */
 987         addr = ((header.r500fp.adrhi_flags & 1) << 8) | header.r500fp.adrlo;
 988
 989         type = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_TYPE);
 990         clamp = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_CLAMP);
 991
 992         addr |= (type << 16);
 993         addr |= (clamp << 17);
 994
 995         stride = type ? 4 : 6;
 996
 997         DRM_DEBUG("r500fp %d %d type: %d\n", sz, addr, type);
 998         if (!sz)
 999                 return 0;
1000         if (sz * stride * 4 > cmdbuf->bufsz)
1001                 return -EINVAL;
1002
1003         BEGIN_RING(3 + sz * stride);
1004         OUT_RING_REG(R500_GA_US_VECTOR_INDEX, addr);
1005         OUT_RING(CP_PACKET0_TABLE(R500_GA_US_VECTOR_DATA, sz * stride - 1));
1006         OUT_RING_TABLE((int *)cmdbuf->buf, sz * stride);
1007
1008         ADVANCE_RING();
1009
1010         cmdbuf->buf += sz * stride * 4;
1011         cmdbuf->bufsz -= sz * stride * 4;
1012
1013         return 0;
1014 }
1015
1016
1017 /**
1018  * Parses and validates a user-supplied command buffer and emits appropriate
1019  * commands on the DMA ring buffer.
1020  * Called by the ioctl handler function radeon_cp_cmdbuf.
1021  */
1022 int r300_do_cp_cmdbuf(struct drm_device *dev,
1023                       struct drm_file *file_priv,
1024                       drm_radeon_kcmd_buffer_t *cmdbuf)
1025 {
1026         drm_radeon_private_t *dev_priv = dev->dev_private;
1027         struct drm_device_dma *dma = dev->dma;
1028         struct drm_buf *buf = NULL;
1029         int emit_dispatch_age = 0;
1030         int ret = 0;
1031
1032         DRM_DEBUG("\n");
1033
1034         /* pacify */
1035         r300_pacify(dev_priv);
1036
1037         if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
1038                 ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
1039                 if (ret)
1040                         goto cleanup;
1041         }
1042
1043         while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
1044                 int idx;
1045                 drm_r300_cmd_header_t header;
1046
1047                 header.u = *(unsigned int *)cmdbuf->buf;
1048
1049                 cmdbuf->buf += sizeof(header);
1050                 cmdbuf->bufsz -= sizeof(header);
1051
1052                 switch (header.header.cmd_type) {
1053                 case R300_CMD_PACKET0:
1054                         DRM_DEBUG("R300_CMD_PACKET0\n");
1055                         ret = r300_emit_packet0(dev_priv, cmdbuf, header);
1056                         if (ret) {
1057                                 DRM_ERROR("r300_emit_packet0 failed\n");
1058                                 goto cleanup;
1059                         }
1060                         break;
1061
1062                 case R300_CMD_VPU:
1063                         DRM_DEBUG("R300_CMD_VPU\n");
1064                         ret = r300_emit_vpu(dev_priv, cmdbuf, header);
1065                         if (ret) {
1066                                 DRM_ERROR("r300_emit_vpu failed\n");
1067                                 goto cleanup;
1068                         }
1069                         break;
1070
1071                 case R300_CMD_PACKET3:
1072                         DRM_DEBUG("R300_CMD_PACKET3\n");
1073                         ret = r300_emit_packet3(dev_priv, cmdbuf, header);
1074                         if (ret) {
1075                                 DRM_ERROR("r300_emit_packet3 failed\n");
1076                                 goto cleanup;
1077                         }
1078                         break;
1079
1080                 case R300_CMD_END3D:
1081                         DRM_DEBUG("R300_CMD_END3D\n");
1082                         /* TODO:
1083                            Ideally userspace driver should not need to issue this call,
1084                            i.e. the drm driver should issue it automatically and prevent
1085                            lockups.
1086
1087                            In practice, we do not understand why this call is needed and what
1088                            it does (except for some vague guesses that it has to do with cache
1089                            coherence) and so the user space driver does it.
1090
1091                            Once we are sure which uses prevent lockups the code could be moved
1092                            into the kernel and the userspace driver will not
1093                            need to use this command.
1094
1095                            Note that issuing this command does not hurt anything
1096                            except, possibly, performance */
1097                         r300_pacify(dev_priv);
1098                         break;
1099
1100                 case R300_CMD_CP_DELAY:
1101                         /* simple enough, we can do it here */
1102                         DRM_DEBUG("R300_CMD_CP_DELAY\n");
1103                         {
1104                                 int i;
1105                                 RING_LOCALS;
1106
1107                                 BEGIN_RING(header.delay.count);
1108                                 for (i = 0; i < header.delay.count; i++)
1109                                         OUT_RING(RADEON_CP_PACKET2);
1110                                 ADVANCE_RING();
1111                         }
1112                         break;
1113
1114                 case R300_CMD_DMA_DISCARD:
1115                         DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
1116                         idx = header.dma.buf_idx;
1117                         if (idx < 0 || idx >= dma->buf_count) {
1118                                 DRM_ERROR("buffer index %d (of %d max)\n",
1119                                           idx, dma->buf_count - 1);
1120                                 ret = -EINVAL;
1121                                 goto cleanup;
1122                         }
1123
1124                         buf = dma->buflist[idx];
1125                         if (buf->file_priv != file_priv || buf->pending) {
1126                                 DRM_ERROR("bad buffer %p %p %d\n",
1127                                           buf->file_priv, file_priv,
1128                                           buf->pending);
1129                                 ret = -EINVAL;
1130                                 goto cleanup;
1131                         }
1132
1133                         emit_dispatch_age = 1;
1134                         r300_discard_buffer(dev, buf);
1135                         break;
1136
1137                 case R300_CMD_WAIT:
1138                         DRM_DEBUG("R300_CMD_WAIT\n");
1139                         r300_cmd_wait(dev_priv, header);
1140                         break;
1141
1142                 case R300_CMD_SCRATCH:
1143                         DRM_DEBUG("R300_CMD_SCRATCH\n");
1144                         ret = r300_scratch(dev_priv, cmdbuf, header);
1145                         if (ret) {
1146                                 DRM_ERROR("r300_scratch failed\n");
1147                                 goto cleanup;
1148                         }
1149                         break;
1150
1151                 case R300_CMD_R500FP:
1152                         if ((dev_priv->flags & RADEON_FAMILY_MASK) < CHIP_RV515) {
1153                                 DRM_ERROR("Calling r500 command on r300 card\n");
1154                                 ret = -EINVAL;
1155                                 goto cleanup;
1156                         }
1157                         DRM_DEBUG("R300_CMD_R500FP\n");
1158                         ret = r300_emit_r500fp(dev_priv, cmdbuf, header);
1159                         if (ret) {
1160                                 DRM_ERROR("r300_emit_r500fp failed\n");
1161                                 goto cleanup;
1162                         }
1163                         break;
1164                 default:
1165                         DRM_ERROR("bad cmd_type %i at %p\n",
1166                                   header.header.cmd_type,
1167                                   cmdbuf->buf - sizeof(header));
1168                         ret = -EINVAL;
1169                         goto cleanup;
1170                 }
1171         }
1172
1173         DRM_DEBUG("END\n");
1174
1175       cleanup:
1176         r300_pacify(dev_priv);
1177
1178         /* We emit the vertex buffer age here, outside the pacifier "brackets"
1179          * for two reasons:
1180          *  (1) This may coalesce multiple age emissions into a single one and
1181          *  (2) more importantly, some chips lock up hard when scratch registers
1182          *      are written inside the pacifier bracket.
1183          */
1184         if (emit_dispatch_age) {
1185                 RING_LOCALS;
1186
1187                 /* Emit the vertex buffer age */
1188                 BEGIN_RING(2);
1189                 RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch);
1190                 ADVANCE_RING();
1191         }
1192
1193         COMMIT_RING();
1194
1195         return ret;
1196 }