sys/dev/drm/r300_cmdbuf.c

   1 /* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
   2  *
   3  * Copyright (C) The Weather Channel, Inc.  2002.
   4  * Copyright (C) 2004 Nicolai Haehnle.
   5  * All Rights Reserved.
   6  *
   7  * The Weather Channel (TM) funded Tungsten Graphics to develop the
   8  * initial release of the Radeon 8500 driver under the XFree86 license.
   9  * This notice must be preserved.
  10  *
  11  * Permission is hereby granted, free of charge, to any person obtaining a
  12  * copy of this software and associated documentation files (the "Software"),
  13  * to deal in the Software without restriction, including without limitation
  14  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15  * and/or sell copies of the Software, and to permit persons to whom the
  16  * Software is furnished to do so, subject to the following conditions:
  17  *
  18  * The above copyright notice and this permission notice (including the next
  19  * paragraph) shall be included in all copies or substantial portions of the
  20  * Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  25  * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  28  * DEALINGS IN THE SOFTWARE.
  29  *
  30  * Authors:
  31  *    Nicolai Haehnle <prefect_@gmx.net>
  32  */
  33
  34 #include <sys/cdefs.h>
  35 __FBSDID("$FreeBSD$");
  36
  37 #include "dev/drm/drmP.h"
  38 #include "dev/drm/drm.h"
  39 #include "dev/drm/radeon_drm.h"
  40 #include "dev/drm/radeon_drv.h"
  41 #include "dev/drm/r300_reg.h"
  42
  43 #define R300_SIMULTANEOUS_CLIPRECTS             4
  44
  45 /* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
  46  */
  47 static const int r300_cliprect_cntl[4] = {
  48         0xAAAA,
  49         0xEEEE,
  50         0xFEFE,
  51         0xFFFE
  52 };
  53
  54 /**
  55  * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
  56  * buffer, starting with index n.
  57  */
  58 static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
  59                                drm_radeon_kcmd_buffer_t *cmdbuf, int n)
  60 {
  61         struct drm_clip_rect box;
  62         int nr;
  63         int i;
  64         RING_LOCALS;
  65
  66         nr = cmdbuf->nbox - n;
  67         if (nr > R300_SIMULTANEOUS_CLIPRECTS)
  68                 nr = R300_SIMULTANEOUS_CLIPRECTS;
  69
  70         DRM_DEBUG("%i cliprects\n", nr);
  71
  72         if (nr) {
  73                 BEGIN_RING(6 + nr * 2);
  74                 OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
  75
  76                 for (i = 0; i < nr; ++i) {
  77                         if (DRM_COPY_FROM_USER_UNCHECKED
  78                             (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
  79                                 DRM_ERROR("copy cliprect faulted\n");
  80                                 return -EFAULT;
  81                         }
  82
  83                         box.x2--; /* Hardware expects inclusive bottom-right corner */
  84                         box.y2--;
  85
  86                         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
  87                                 box.x1 = (box.x1) &
  88                                         R300_CLIPRECT_MASK;
  89                                 box.y1 = (box.y1) &
  90                                         R300_CLIPRECT_MASK;
  91                                 box.x2 = (box.x2) &
  92                                         R300_CLIPRECT_MASK;
  93                                 box.y2 = (box.y2) &
  94                                         R300_CLIPRECT_MASK;
  95                         } else {
  96                                 box.x1 = (box.x1 + R300_CLIPRECT_OFFSET) &
  97                                         R300_CLIPRECT_MASK;
  98                                 box.y1 = (box.y1 + R300_CLIPRECT_OFFSET) &
  99                                         R300_CLIPRECT_MASK;
 100                                 box.x2 = (box.x2 + R300_CLIPRECT_OFFSET) &
 101                                         R300_CLIPRECT_MASK;
 102                                 box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) &
 103                                         R300_CLIPRECT_MASK;
 104                         }
 105
 106                         OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
 107                                  (box.y1 << R300_CLIPRECT_Y_SHIFT));
 108                         OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
 109                                  (box.y2 << R300_CLIPRECT_Y_SHIFT));
 110
 111                 }
 112
 113                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr - 1]);
 114
 115                 /* TODO/SECURITY: Force scissors to a safe value, otherwise the
 116                  * client might be able to trample over memory.
 117                  * The impact should be very limited, but I'd rather be safe than
 118                  * sorry.
 119                  */
 120                 OUT_RING(CP_PACKET0(R300_RE_SCISSORS_TL, 1));
 121                 OUT_RING(0);
 122                 OUT_RING(R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK);
 123                 ADVANCE_RING();
 124         } else {
 125                 /* Why we allow zero cliprect rendering:
 126                  * There are some commands in a command buffer that must be submitted
 127                  * even when there are no cliprects, e.g. DMA buffer discard
 128                  * or state setting (though state setting could be avoided by
 129                  * simulating a loss of context).
 130                  *
 131                  * Now since the cmdbuf interface is so chaotic right now (and is
 132                  * bound to remain that way for a bit until things settle down),
 133                  * it is basically impossible to filter out the commands that are
 134                  * necessary and those that aren't.
 135                  *
 136                  * So I choose the safe way and don't do any filtering at all;
 137                  * instead, I simply set up the engine so that all rendering
 138                  * can't produce any fragments.
 139                  */
 140                 BEGIN_RING(2);
 141                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, 0);
 142                 ADVANCE_RING();
 143         }
 144
 145         /* flus cache and wait idle clean after cliprect change */
 146         BEGIN_RING(2);
 147         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 148         OUT_RING(R300_RB3D_DC_FLUSH);
 149         ADVANCE_RING();
 150         BEGIN_RING(2);
 151         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 152         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 153         ADVANCE_RING();
 154         /* set flush flag */
 155         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 156
 157         return 0;
 158 }
 159
 160 static u8 r300_reg_flags[0x10000 >> 2];
 161
 162 void r300_init_reg_flags(struct drm_device *dev)
 163 {
 164         int i;
 165         drm_radeon_private_t *dev_priv = dev->dev_private;
 166
 167         memset(r300_reg_flags, 0, 0x10000 >> 2);
 168 #define ADD_RANGE_MARK(reg, count,mark) \
 169                 for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
 170                         r300_reg_flags[i]|=(mark);
 171
 172 #define MARK_SAFE               1
 173 #define MARK_CHECK_OFFSET       2
 174
 175 #define ADD_RANGE(reg, count)   ADD_RANGE_MARK(reg, count, MARK_SAFE)
 176
 177         /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
 178         ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
 179         ADD_RANGE(R300_VAP_CNTL, 1);
 180         ADD_RANGE(R300_SE_VTE_CNTL, 2);
 181         ADD_RANGE(0x2134, 2);
 182         ADD_RANGE(R300_VAP_CNTL_STATUS, 1);
 183         ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
 184         ADD_RANGE(0x21DC, 1);
 185         ADD_RANGE(R300_VAP_UNKNOWN_221C, 1);
 186         ADD_RANGE(R300_VAP_CLIP_X_0, 4);
 187         ADD_RANGE(R300_VAP_PVS_STATE_FLUSH_REG, 1);
 188         ADD_RANGE(R300_VAP_UNKNOWN_2288, 1);
 189         ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
 190         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
 191         ADD_RANGE(R300_GB_ENABLE, 1);
 192         ADD_RANGE(R300_GB_MSPOS0, 5);
 193         ADD_RANGE(R300_TX_INVALTAGS, 1);
 194         ADD_RANGE(R300_TX_ENABLE, 1);
 195         ADD_RANGE(0x4200, 4);
 196         ADD_RANGE(0x4214, 1);
 197         ADD_RANGE(R300_RE_POINTSIZE, 1);
 198         ADD_RANGE(0x4230, 3);
 199         ADD_RANGE(R300_RE_LINE_CNT, 1);
 200         ADD_RANGE(R300_RE_UNK4238, 1);
 201         ADD_RANGE(0x4260, 3);
 202         ADD_RANGE(R300_RE_SHADE, 4);
 203         ADD_RANGE(R300_RE_POLYGON_MODE, 5);
 204         ADD_RANGE(R300_RE_ZBIAS_CNTL, 1);
 205         ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
 206         ADD_RANGE(R300_RE_OCCLUSION_CNTL, 1);
 207         ADD_RANGE(R300_RE_CULL_CNTL, 1);
 208         ADD_RANGE(0x42C0, 2);
 209         ADD_RANGE(R300_RS_CNTL_0, 2);
 210
 211         ADD_RANGE(R300_SC_HYPERZ, 2);
 212         ADD_RANGE(0x43E8, 1);
 213
 214         ADD_RANGE(0x46A4, 5);
 215
 216         ADD_RANGE(R300_RE_FOG_STATE, 1);
 217         ADD_RANGE(R300_FOG_COLOR_R, 3);
 218         ADD_RANGE(R300_PP_ALPHA_TEST, 2);
 219         ADD_RANGE(0x4BD8, 1);
 220         ADD_RANGE(R300_PFS_PARAM_0_X, 64);
 221         ADD_RANGE(0x4E00, 1);
 222         ADD_RANGE(R300_RB3D_CBLEND, 2);
 223         ADD_RANGE(R300_RB3D_COLORMASK, 1);
 224         ADD_RANGE(R300_RB3D_BLEND_COLOR, 3);
 225         ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET);   /* check offset */
 226         ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
 227         ADD_RANGE(0x4E50, 9);
 228         ADD_RANGE(0x4E88, 1);
 229         ADD_RANGE(0x4EA0, 2);
 230         ADD_RANGE(R300_ZB_CNTL, 3);
 231         ADD_RANGE(R300_ZB_FORMAT, 4);
 232         ADD_RANGE_MARK(R300_ZB_DEPTHOFFSET, 1, MARK_CHECK_OFFSET);      /* check offset */
 233         ADD_RANGE(R300_ZB_DEPTHPITCH, 1);
 234         ADD_RANGE(R300_ZB_DEPTHCLEARVALUE, 1);
 235         ADD_RANGE(R300_ZB_ZMASK_OFFSET, 13);
 236
 237         ADD_RANGE(R300_TX_FILTER_0, 16);
 238         ADD_RANGE(R300_TX_FILTER1_0, 16);
 239         ADD_RANGE(R300_TX_SIZE_0, 16);
 240         ADD_RANGE(R300_TX_FORMAT_0, 16);
 241         ADD_RANGE(R300_TX_PITCH_0, 16);
 242         /* Texture offset is dangerous and needs more checking */
 243         ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
 244         ADD_RANGE(R300_TX_CHROMA_KEY_0, 16);
 245         ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
 246
 247         /* Sporadic registers used as primitives are emitted */
 248         ADD_RANGE(R300_ZB_ZCACHE_CTLSTAT, 1);
 249         ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
 250         ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
 251         ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
 252
 253         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
 254                 ADD_RANGE(R500_VAP_INDEX_OFFSET, 1);
 255                 ADD_RANGE(R500_US_CONFIG, 2);
 256                 ADD_RANGE(R500_US_CODE_ADDR, 3);
 257                 ADD_RANGE(R500_US_FC_CTRL, 1);
 258                 ADD_RANGE(R500_RS_IP_0, 16);
 259                 ADD_RANGE(R500_RS_INST_0, 16);
 260                 ADD_RANGE(R500_RB3D_COLOR_CLEAR_VALUE_AR, 2);
 261                 ADD_RANGE(R500_RB3D_CONSTANT_COLOR_AR, 2);
 262                 ADD_RANGE(R500_ZB_FIFO_SIZE, 2);
 263         } else {
 264                 ADD_RANGE(R300_PFS_CNTL_0, 3);
 265                 ADD_RANGE(R300_PFS_NODE_0, 4);
 266                 ADD_RANGE(R300_PFS_TEXI_0, 64);
 267                 ADD_RANGE(R300_PFS_INSTR0_0, 64);
 268                 ADD_RANGE(R300_PFS_INSTR1_0, 64);
 269                 ADD_RANGE(R300_PFS_INSTR2_0, 64);
 270                 ADD_RANGE(R300_PFS_INSTR3_0, 64);
 271                 ADD_RANGE(R300_RS_INTERP_0, 8);
 272                 ADD_RANGE(R300_RS_ROUTE_0, 8);
 273
 274         }
 275 }
 276
 277 static __inline__ int r300_check_range(unsigned reg, int count)
 278 {
 279         int i;
 280         if (reg & ~0xffff)
 281                 return -1;
 282         for (i = (reg >> 2); i < (reg >> 2) + count; i++)
 283                 if (r300_reg_flags[i] != MARK_SAFE)
 284                         return 1;
 285         return 0;
 286 }
 287
 288 static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
 289                                                           dev_priv,
 290                                                           drm_radeon_kcmd_buffer_t
 291                                                           * cmdbuf,
 292                                                           drm_r300_cmd_header_t
 293                                                           header)
 294 {
 295         int reg;
 296         int sz;
 297         int i;
 298         int values[64];
 299         RING_LOCALS;
 300
 301         sz = header.packet0.count;
 302         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 303
 304         if ((sz > 64) || (sz < 0)) {
 305                 DRM_ERROR
 306                     ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
 307                      reg, sz);
 308                 return -EINVAL;
 309         }
 310         for (i = 0; i < sz; i++) {
 311                 values[i] = ((int *)cmdbuf->buf)[i];
 312                 switch (r300_reg_flags[(reg >> 2) + i]) {
 313                 case MARK_SAFE:
 314                         break;
 315                 case MARK_CHECK_OFFSET:
 316                         if (!radeon_check_offset(dev_priv, (u32) values[i])) {
 317                                 DRM_ERROR
 318                                     ("Offset failed range check (reg=%04x sz=%d)\n",
 319                                      reg, sz);
 320                                 return -EINVAL;
 321                         }
 322                         break;
 323                 default:
 324                         DRM_ERROR("Register %04x failed check as flag=%02x\n",
 325                                   reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
 326                         return -EINVAL;
 327                 }
 328         }
 329
 330         BEGIN_RING(1 + sz);
 331         OUT_RING(CP_PACKET0(reg, sz - 1));
 332         OUT_RING_TABLE(values, sz);
 333         ADVANCE_RING();
 334
 335         cmdbuf->buf += sz * 4;
 336         cmdbuf->bufsz -= sz * 4;
 337
 338         return 0;
 339 }
 340
 341 /**
 342  * Emits a packet0 setting arbitrary registers.
 343  * Called by r300_do_cp_cmdbuf.
 344  *
 345  * Note that checks are performed on contents and addresses of the registers
 346  */
 347 static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
 348                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 349                                         drm_r300_cmd_header_t header)
 350 {
 351         int reg;
 352         int sz;
 353         RING_LOCALS;
 354
 355         sz = header.packet0.count;
 356         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 357
 358         DRM_DEBUG("R300_CMD_PACKET0: reg %04x, sz %d\n", reg, sz);
 359         if (!sz)
 360                 return 0;
 361
 362         if (sz * 4 > cmdbuf->bufsz)
 363                 return -EINVAL;
 364
 365         if (reg + sz * 4 >= 0x10000) {
 366                 DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg,
 367                           sz);
 368                 return -EINVAL;
 369         }
 370
 371         if (r300_check_range(reg, sz)) {
 372                 /* go and check everything */
 373                 return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf,
 374                                                            header);
 375         }
 376         /* the rest of the data is safe to emit, whatever the values the user passed */
 377
 378         BEGIN_RING(1 + sz);
 379         OUT_RING(CP_PACKET0(reg, sz - 1));
 380         OUT_RING_TABLE((int *)cmdbuf->buf, sz);
 381         ADVANCE_RING();
 382
 383         cmdbuf->buf += sz * 4;
 384         cmdbuf->bufsz -= sz * 4;
 385
 386         return 0;
 387 }
 388
 389 /**
 390  * Uploads user-supplied vertex program instructions or parameters onto
 391  * the graphics card.
 392  * Called by r300_do_cp_cmdbuf.
 393  */
 394 static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
 395                                     drm_radeon_kcmd_buffer_t *cmdbuf,
 396                                     drm_r300_cmd_header_t header)
 397 {
 398         int sz;
 399         int addr;
 400         RING_LOCALS;
 401
 402         sz = header.vpu.count;
 403         addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
 404
 405         if (!sz)
 406                 return 0;
 407         if (sz * 16 > cmdbuf->bufsz)
 408                 return -EINVAL;
 409
 410         /* VAP is very sensitive so we purge cache before we program it
 411          * and we also flush its state before & after */
 412         BEGIN_RING(6);
 413         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 414         OUT_RING(R300_RB3D_DC_FLUSH);
 415         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 416         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 417         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 418         OUT_RING(0);
 419         ADVANCE_RING();
 420         /* set flush flag */
 421         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 422
 423         BEGIN_RING(3 + sz * 4);
 424         OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
 425         OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
 426         OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4);
 427         ADVANCE_RING();
 428
 429         BEGIN_RING(2);
 430         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 431         OUT_RING(0);
 432         ADVANCE_RING();
 433
 434         cmdbuf->buf += sz * 16;
 435         cmdbuf->bufsz -= sz * 16;
 436
 437         return 0;
 438 }
 439
 440 /**
 441  * Emit a clear packet from userspace.
 442  * Called by r300_emit_packet3.
 443  */
 444 static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
 445                                       drm_radeon_kcmd_buffer_t *cmdbuf)
 446 {
 447         RING_LOCALS;
 448
 449         if (8 * 4 > cmdbuf->bufsz)
 450                 return -EINVAL;
 451
 452         BEGIN_RING(10);
 453         OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8));
 454         OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING |
 455                  (1 << R300_PRIM_NUM_VERTICES_SHIFT));
 456         OUT_RING_TABLE((int *)cmdbuf->buf, 8);
 457         ADVANCE_RING();
 458
 459         BEGIN_RING(4);
 460         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 461         OUT_RING(R300_RB3D_DC_FLUSH);
 462         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 463         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 464         ADVANCE_RING();
 465         /* set flush flag */
 466         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 467
 468         cmdbuf->buf += 8 * 4;
 469         cmdbuf->bufsz -= 8 * 4;
 470
 471         return 0;
 472 }
 473
 474 static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 475                                                drm_radeon_kcmd_buffer_t *cmdbuf,
 476                                                u32 header)
 477 {
 478         int count, i, k;
 479 #define MAX_ARRAY_PACKET  64
 480         u32 payload[MAX_ARRAY_PACKET];
 481         u32 narrays;
 482         RING_LOCALS;
 483
 484         count = (header >> 16) & 0x3fff;
 485
 486         if ((count + 1) > MAX_ARRAY_PACKET) {
 487                 DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
 488                           count);
 489                 return -EINVAL;
 490         }
 491         memset(payload, 0, MAX_ARRAY_PACKET * 4);
 492         memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);
 493
 494         /* carefully check packet contents */
 495
 496         narrays = payload[0];
 497         k = 0;
 498         i = 1;
 499         while ((k < narrays) && (i < (count + 1))) {
 500                 i++;            /* skip attribute field */
 501                 if (!radeon_check_offset(dev_priv, payload[i])) {
 502                         DRM_ERROR
 503                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 504                              k, i);
 505                         return -EINVAL;
 506                 }
 507                 k++;
 508                 i++;
 509                 if (k == narrays)
 510                         break;
 511                 /* have one more to process, they come in pairs */
 512                 if (!radeon_check_offset(dev_priv, payload[i])) {
 513                         DRM_ERROR
 514                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 515                              k, i);
 516                         return -EINVAL;
 517                 }
 518                 k++;
 519                 i++;
 520         }
 521         /* do the counts match what we expect ? */
 522         if ((k != narrays) || (i != (count + 1))) {
 523                 DRM_ERROR
 524                     ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",
 525                      k, i, narrays, count + 1);
 526                 return -EINVAL;
 527         }
 528
 529         /* all clear, output packet */
 530
 531         BEGIN_RING(count + 2);
 532         OUT_RING(header);
 533         OUT_RING_TABLE(payload, count + 1);
 534         ADVANCE_RING();
 535
 536         cmdbuf->buf += (count + 2) * 4;
 537         cmdbuf->bufsz -= (count + 2) * 4;
 538
 539         return 0;
 540 }
 541
 542 static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
 543                                              drm_radeon_kcmd_buffer_t *cmdbuf)
 544 {
 545         u32 *cmd = (u32 *) cmdbuf->buf;
 546         int count, ret;
 547         RING_LOCALS;
 548
 549         count=(cmd[0]>>16) & 0x3fff;
 550
 551         if (cmd[0] & 0x8000) {
 552                 u32 offset;
 553
 554                 if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
 555                               | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 556                         offset = cmd[2] << 10;
 557                         ret = !radeon_check_offset(dev_priv, offset);
 558                         if (ret) {
 559                                 DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
 560                                 return -EINVAL;
 561                         }
 562                 }
 563
 564                 if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
 565                     (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 566                         offset = cmd[3] << 10;
 567                         ret = !radeon_check_offset(dev_priv, offset);
 568                         if (ret) {
 569                                 DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
 570                                 return -EINVAL;
 571                         }
 572
 573                 }
 574         }
 575
 576         BEGIN_RING(count+2);
 577         OUT_RING(cmd[0]);
 578         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 579         ADVANCE_RING();
 580
 581         cmdbuf->buf += (count+2)*4;
 582         cmdbuf->bufsz -= (count+2)*4;
 583
 584         return 0;
 585 }
 586
 587 static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
 588                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 589 {
 590         u32 *cmd;
 591         int count;
 592         int expected_count;
 593         RING_LOCALS;
 594
 595         cmd = (u32 *) cmdbuf->buf;
 596         count = (cmd[0]>>16) & 0x3fff;
 597         expected_count = cmd[1] >> 16;
 598         if (!(cmd[1] & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
 599                 expected_count = (expected_count+1)/2;
 600
 601         if (count && count != expected_count) {
 602                 DRM_ERROR("3D_DRAW_INDX_2: packet size %i, expected %i\n",
 603                         count, expected_count);
 604                 return -EINVAL;
 605         }
 606
 607         BEGIN_RING(count+2);
 608         OUT_RING(cmd[0]);
 609         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 610         ADVANCE_RING();
 611
 612         cmdbuf->buf += (count+2)*4;
 613         cmdbuf->bufsz -= (count+2)*4;
 614
 615         if (!count) {
 616                 drm_r300_cmd_header_t header;
 617
 618                 if (cmdbuf->bufsz < 4*4 + sizeof(header)) {
 619                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER, but stream is too short.\n");
 620                         return -EINVAL;
 621                 }
 622
 623                 header.u = *(unsigned int *)cmdbuf->buf;
 624
 625                 cmdbuf->buf += sizeof(header);
 626                 cmdbuf->bufsz -= sizeof(header);
 627                 cmd = (u32 *) cmdbuf->buf;
 628
 629                 if (header.header.cmd_type != R300_CMD_PACKET3 ||
 630                     header.packet3.packet != R300_CMD_PACKET3_RAW ||
 631                     cmd[0] != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
 632                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER.\n");
 633                         return -EINVAL;
 634                 }
 635
 636                 if ((cmd[1] & 0x8000ffff) != 0x80000810) {
 637                         DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
 638                         return -EINVAL;
 639                 }
 640                 if (!radeon_check_offset(dev_priv, cmd[2])) {
 641                         DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
 642                         return -EINVAL;
 643                 }
 644                 if (cmd[3] != expected_count) {
 645                         DRM_ERROR("INDX_BUFFER: buffer size %i, expected %i\n",
 646                                 cmd[3], expected_count);
 647                         return -EINVAL;
 648                 }
 649
 650                 BEGIN_RING(4);
 651                 OUT_RING(cmd[0]);
 652                 OUT_RING_TABLE((int *)(cmdbuf->buf + 4), 3);
 653                 ADVANCE_RING();
 654
 655                 cmdbuf->buf += 4*4;
 656                 cmdbuf->bufsz -= 4*4;
 657         }
 658
 659         return 0;
 660 }
 661
 662 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
 663                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 664 {
 665         u32 header;
 666         int count;
 667         RING_LOCALS;
 668
 669         if (4 > cmdbuf->bufsz)
 670                 return -EINVAL;
 671
 672         /* Fixme !! This simply emits a packet without much checking.
 673            We need to be smarter. */
 674
 675         /* obtain first word - actual packet3 header */
 676         header = *(u32 *) cmdbuf->buf;
 677
 678         /* Is it packet 3 ? */
 679         if ((header >> 30) != 0x3) {
 680                 DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
 681                 return -EINVAL;
 682         }
 683
 684         count = (header >> 16) & 0x3fff;
 685
 686         /* Check again now that we know how much data to expect */
 687         if ((count + 2) * 4 > cmdbuf->bufsz) {
 688                 DRM_ERROR
 689                     ("Expected packet3 of length %d but have only %d bytes left\n",
 690                      (count + 2) * 4, cmdbuf->bufsz);
 691                 return -EINVAL;
 692         }
 693
 694         /* Is it a packet type we know about ? */
 695         switch (header & 0xff00) {
 696         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
 697                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 698
 699         case RADEON_CNTL_BITBLT_MULTI:
 700                 return r300_emit_bitblt_multi(dev_priv, cmdbuf);
 701
 702         case RADEON_CP_INDX_BUFFER:
 703                 DRM_ERROR("packet3 INDX_BUFFER without preceding 3D_DRAW_INDX_2 is illegal.\n");
 704                 return -EINVAL;
 705         case RADEON_CP_3D_DRAW_IMMD_2:
 706                 /* triggers drawing using in-packet vertex data */
 707         case RADEON_CP_3D_DRAW_VBUF_2:
 708                 /* triggers drawing of vertex buffers setup elsewhere */
 709                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 710                                            RADEON_PURGE_EMITED);
 711                 break;
 712         case RADEON_CP_3D_DRAW_INDX_2:
 713                 /* triggers drawing using indices to vertex buffer */
 714                 /* whenever we send vertex we clear flush & purge */
 715                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 716                                            RADEON_PURGE_EMITED);
 717                 return r300_emit_draw_indx_2(dev_priv, cmdbuf);
 718         case RADEON_WAIT_FOR_IDLE:
 719         case RADEON_CP_NOP:
 720                 /* these packets are safe */
 721                 break;
 722         default:
 723                 DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
 724                 return -EINVAL;
 725         }
 726
 727         BEGIN_RING(count + 2);
 728         OUT_RING(header);
 729         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 730         ADVANCE_RING();
 731
 732         cmdbuf->buf += (count + 2) * 4;
 733         cmdbuf->bufsz -= (count + 2) * 4;
 734
 735         return 0;
 736 }
 737
 738 /**
 739  * Emit a rendering packet3 from userspace.
 740  * Called by r300_do_cp_cmdbuf.
 741  */
 742 static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
 743                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 744                                         drm_r300_cmd_header_t header)
 745 {
 746         int n;
 747         int ret;
 748         char *orig_buf = cmdbuf->buf;
 749         int orig_bufsz = cmdbuf->bufsz;
 750
 751         /* This is a do-while-loop so that we run the interior at least once,
 752          * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
 753          */
 754         n = 0;
 755         do {
 756                 if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
 757                         ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
 758                         if (ret)
 759                                 return ret;
 760
 761                         cmdbuf->buf = orig_buf;
 762                         cmdbuf->bufsz = orig_bufsz;
 763                 }
 764
 765                 switch (header.packet3.packet) {
 766                 case R300_CMD_PACKET3_CLEAR:
 767                         DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
 768                         ret = r300_emit_clear(dev_priv, cmdbuf);
 769                         if (ret) {
 770                                 DRM_ERROR("r300_emit_clear failed\n");
 771                                 return ret;
 772                         }
 773                         break;
 774
 775                 case R300_CMD_PACKET3_RAW:
 776                         DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
 777                         ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
 778                         if (ret) {
 779                                 DRM_ERROR("r300_emit_raw_packet3 failed\n");
 780                                 return ret;
 781                         }
 782                         break;
 783
 784                 default:
 785                         DRM_ERROR("bad packet3 type %i at %p\n",
 786                                   header.packet3.packet,
 787                                   cmdbuf->buf - sizeof(header));
 788                         return -EINVAL;
 789                 }
 790
 791                 n += R300_SIMULTANEOUS_CLIPRECTS;
 792         } while (n < cmdbuf->nbox);
 793
 794         return 0;
 795 }
 796
 797 /* Some of the R300 chips seem to be extremely touchy about the two registers
 798  * that are configured in r300_pacify.
 799  * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
 800  * sends a command buffer that contains only state setting commands and a
 801  * vertex program/parameter upload sequence, this will eventually lead to a
 802  * lockup, unless the sequence is bracketed by calls to r300_pacify.
 803  * So we should take great care to *always* call r300_pacify before
 804  * *anything* 3D related, and again afterwards. This is what the
 805  * call bracket in r300_do_cp_cmdbuf is for.
 806  */
 807
 808 /**
 809  * Emit the sequence to pacify R300.
 810  */
 811 static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv)
 812 {
 813         uint32_t cache_z, cache_3d, cache_2d;
 814         RING_LOCALS;
 815
 816         cache_z = R300_ZC_FLUSH;
 817         cache_2d = R300_RB2D_DC_FLUSH;
 818         cache_3d = R300_RB3D_DC_FLUSH;
 819         if (!(dev_priv->track_flush & RADEON_PURGE_EMITED)) {
 820                 /* we can purge, primitive where draw since last purge */
 821                 cache_z |= R300_ZC_FREE;
 822                 cache_2d |= R300_RB2D_DC_FREE;
 823                 cache_3d |= R300_RB3D_DC_FREE;
 824         }
 825
 826         /* flush & purge zbuffer */
 827         BEGIN_RING(2);
 828         OUT_RING(CP_PACKET0(R300_ZB_ZCACHE_CTLSTAT, 0));
 829         OUT_RING(cache_z);
 830         ADVANCE_RING();
 831         /* flush & purge 3d */
 832         BEGIN_RING(2);
 833         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 834         OUT_RING(cache_3d);
 835         ADVANCE_RING();
 836         /* flush & purge texture */
 837         BEGIN_RING(2);
 838         OUT_RING(CP_PACKET0(R300_TX_INVALTAGS, 0));
 839         OUT_RING(0);
 840         ADVANCE_RING();
 841         /* FIXME: is this one really needed ? */
 842         BEGIN_RING(2);
 843         OUT_RING(CP_PACKET0(R300_RB3D_AARESOLVE_CTL, 0));
 844         OUT_RING(0);
 845         ADVANCE_RING();
 846         BEGIN_RING(2);
 847         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 848         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 849         ADVANCE_RING();
 850         /* flush & purge 2d through E2 as RB2D will trigger lockup */
 851         BEGIN_RING(4);
 852         OUT_RING(CP_PACKET0(R300_DSTCACHE_CTLSTAT, 0));
 853         OUT_RING(cache_2d);
 854         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 855         OUT_RING(RADEON_WAIT_2D_IDLECLEAN |
 856                  RADEON_WAIT_HOST_IDLECLEAN);
 857         ADVANCE_RING();
 858         /* set flush & purge flags */
 859         dev_priv->track_flush |= RADEON_FLUSH_EMITED | RADEON_PURGE_EMITED;
 860 }
 861
 862 /**
 863  * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
 864  * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
 865  * be careful about how this function is called.
 866  */
 867 static void r300_discard_buffer(struct drm_device * dev, struct drm_buf * buf)
 868 {
 869         drm_radeon_private_t *dev_priv = dev->dev_private;
 870         drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
 871
 872         buf_priv->age = ++dev_priv->sarea_priv->last_dispatch;
 873         buf->pending = 1;
 874         buf->used = 0;
 875 }
 876
 877 static void r300_cmd_wait(drm_radeon_private_t * dev_priv,
 878                           drm_r300_cmd_header_t header)
 879 {
 880         u32 wait_until;
 881         RING_LOCALS;
 882
 883         if (!header.wait.flags)
 884                 return;
 885
 886         wait_until = 0;
 887
 888         switch(header.wait.flags) {
 889         case R300_WAIT_2D:
 890                 wait_until = RADEON_WAIT_2D_IDLE;
 891                 break;
 892         case R300_WAIT_3D:
 893                 wait_until = RADEON_WAIT_3D_IDLE;
 894                 break;
 895         case R300_NEW_WAIT_2D_3D:
 896                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_3D_IDLE;
 897                 break;
 898         case R300_NEW_WAIT_2D_2D_CLEAN:
 899                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 900                 break;
 901         case R300_NEW_WAIT_3D_3D_CLEAN:
 902                 wait_until = RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 903                 break;
 904         case R300_NEW_WAIT_2D_2D_CLEAN_3D_3D_CLEAN:
 905                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 906                 wait_until |= RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 907                 break;
 908         default:
 909                 return;
 910         }
 911
 912         BEGIN_RING(2);
 913         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 914         OUT_RING(wait_until);
 915         ADVANCE_RING();
 916 }
 917
 918 static int r300_scratch(drm_radeon_private_t *dev_priv,
 919                         drm_radeon_kcmd_buffer_t *cmdbuf,
 920                         drm_r300_cmd_header_t header)
 921 {
 922         u32 *ref_age_base;
 923         u32 i, buf_idx, h_pending;
 924         RING_LOCALS;
 925
 926         if (cmdbuf->bufsz < sizeof(uint64_t) + header.scratch.n_bufs * sizeof(buf_idx) ) {
 927                 return -EINVAL;
 928         }
 929
 930         if (header.scratch.reg >= 5) {
 931                 return -EINVAL;
 932         }
 933
 934         dev_priv->scratch_ages[header.scratch.reg] ++;
 935
 936         ref_age_base = (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
 937
 938         cmdbuf->buf += sizeof(uint64_t);
 939         cmdbuf->bufsz -= sizeof(uint64_t);
 940
 941         for (i=0; i < header.scratch.n_bufs; i++) {
 942                 buf_idx = *(u32 *)cmdbuf->buf;
 943                 buf_idx *= 2; /* 8 bytes per buf */
 944
 945                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
 946                         return -EINVAL;
 947                 }
 948
 949                 if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + buf_idx + 1, sizeof(u32))) {
 950                         return -EINVAL;
 951                 }
 952
 953                 if (h_pending == 0) {
 954                         return -EINVAL;
 955                 }
 956
 957                 h_pending--;
 958
 959                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx + 1, &h_pending, sizeof(u32))) {
 960                         return -EINVAL;
 961                 }
 962
 963                 cmdbuf->buf += sizeof(buf_idx);
 964                 cmdbuf->bufsz -= sizeof(buf_idx);
 965         }
 966
 967         BEGIN_RING(2);
 968         OUT_RING( CP_PACKET0( RADEON_SCRATCH_REG0 + header.scratch.reg * 4, 0 ) );
 969         OUT_RING( dev_priv->scratch_ages[header.scratch.reg] );
 970         ADVANCE_RING();
 971
 972         return 0;
 973 }
 974
 975 /**
 976  * Uploads user-supplied vertex program instructions or parameters onto
 977  * the graphics card.
 978  * Called by r300_do_cp_cmdbuf.
 979  */
 980 static __inline__ int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
 981                                        drm_radeon_kcmd_buffer_t *cmdbuf,
 982                                        drm_r300_cmd_header_t header)
 983 {
 984         int sz;
 985         int addr;
 986         int type;
 987         int clamp;
 988         int stride;
 989         RING_LOCALS;
 990
 991         sz = header.r500fp.count;
 992         /* address is 9 bits 0 - 8, bit 1 of flags is part of address */
 993         addr = ((header.r500fp.adrhi_flags & 1) << 8) | header.r500fp.adrlo;
 994
 995         type = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_TYPE);
 996         clamp = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_CLAMP);
 997
 998         addr |= (type << 16);
 999         addr |= (clamp << 17);
1000
1001         stride = type ? 4 : 6;
1002
1003         DRM_DEBUG("r500fp %d %d type: %d\n", sz, addr, type);
1004         if (!sz)
1005                 return 0;
1006         if (sz * stride * 4 > cmdbuf->bufsz)
1007                 return -EINVAL;
1008
1009         BEGIN_RING(3 + sz * stride);
1010         OUT_RING_REG(R500_GA_US_VECTOR_INDEX, addr);
1011         OUT_RING(CP_PACKET0_TABLE(R500_GA_US_VECTOR_DATA, sz * stride - 1));
1012         OUT_RING_TABLE((int *)cmdbuf->buf, sz * stride);
1013
1014         ADVANCE_RING();
1015
1016         cmdbuf->buf += sz * stride * 4;
1017         cmdbuf->bufsz -= sz * stride * 4;
1018
1019         return 0;
1020 }
1021
1022
1023 /**
1024  * Parses and validates a user-supplied command buffer and emits appropriate
1025  * commands on the DMA ring buffer.
1026  * Called by the ioctl handler function radeon_cp_cmdbuf.
1027  */
1028 int r300_do_cp_cmdbuf(struct drm_device *dev,
1029                       struct drm_file *file_priv,
1030                       drm_radeon_kcmd_buffer_t *cmdbuf)
1031 {
1032         drm_radeon_private_t *dev_priv = dev->dev_private;
1033         struct drm_device_dma *dma = dev->dma;
1034         struct drm_buf *buf = NULL;
1035         int emit_dispatch_age = 0;
1036         int ret = 0;
1037
1038         DRM_DEBUG("\n");
1039
1040         /* pacify */
1041         r300_pacify(dev_priv);
1042
1043         if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
1044                 ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
1045                 if (ret)
1046                         goto cleanup;
1047         }
1048
1049         while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
1050                 int idx;
1051                 drm_r300_cmd_header_t header;
1052
1053                 header.u = *(unsigned int *)cmdbuf->buf;
1054
1055                 cmdbuf->buf += sizeof(header);
1056                 cmdbuf->bufsz -= sizeof(header);
1057
1058                 switch (header.header.cmd_type) {
1059                 case R300_CMD_PACKET0:
1060                         ret = r300_emit_packet0(dev_priv, cmdbuf, header);
1061                         if (ret) {
1062                                 DRM_ERROR("r300_emit_packet0 failed\n");
1063                                 goto cleanup;
1064                         }
1065                         break;
1066
1067                 case R300_CMD_VPU:
1068                         DRM_DEBUG("R300_CMD_VPU\n");
1069                         ret = r300_emit_vpu(dev_priv, cmdbuf, header);
1070                         if (ret) {
1071                                 DRM_ERROR("r300_emit_vpu failed\n");
1072                                 goto cleanup;
1073                         }
1074                         break;
1075
1076                 case R300_CMD_PACKET3:
1077                         DRM_DEBUG("R300_CMD_PACKET3\n");
1078                         ret = r300_emit_packet3(dev_priv, cmdbuf, header);
1079                         if (ret) {
1080                                 DRM_ERROR("r300_emit_packet3 failed\n");
1081                                 goto cleanup;
1082                         }
1083                         break;
1084
1085                 case R300_CMD_END3D:
1086                         DRM_DEBUG("R300_CMD_END3D\n");
1087                         /* TODO:
1088                            Ideally userspace driver should not need to issue this call,
1089                            i.e. the drm driver should issue it automatically and prevent
1090                            lockups.
1091
1092                            In practice, we do not understand why this call is needed and what
1093                            it does (except for some vague guesses that it has to do with cache
1094                            coherence) and so the user space driver does it.
1095
1096                            Once we are sure which uses prevent lockups the code could be moved
1097                            into the kernel and the userspace driver will not
1098                            need to use this command.
1099
1100                            Note that issuing this command does not hurt anything
1101                            except, possibly, performance */
1102                         r300_pacify(dev_priv);
1103                         break;
1104
1105                 case R300_CMD_CP_DELAY:
1106                         /* simple enough, we can do it here */
1107                         DRM_DEBUG("R300_CMD_CP_DELAY\n");
1108                         {
1109                                 int i;
1110                                 RING_LOCALS;
1111
1112                                 BEGIN_RING(header.delay.count);
1113                                 for (i = 0; i < header.delay.count; i++)
1114                                         OUT_RING(RADEON_CP_PACKET2);
1115                                 ADVANCE_RING();
1116                         }
1117                         break;
1118
1119                 case R300_CMD_DMA_DISCARD:
1120                         DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
1121                         idx = header.dma.buf_idx;
1122                         if (idx < 0 || idx >= dma->buf_count) {
1123                                 DRM_ERROR("buffer index %d (of %d max)\n",
1124                                           idx, dma->buf_count - 1);
1125                                 ret = -EINVAL;
1126                                 goto cleanup;
1127                         }
1128
1129                         buf = dma->buflist[idx];
1130                         if (buf->file_priv != file_priv || buf->pending) {
1131                                 DRM_ERROR("bad buffer %p %p %d\n",
1132                                           buf->file_priv, file_priv,
1133                                           buf->pending);
1134                                 ret = -EINVAL;
1135                                 goto cleanup;
1136                         }
1137
1138                         emit_dispatch_age = 1;
1139                         r300_discard_buffer(dev, buf);
1140                         break;
1141
1142                 case R300_CMD_WAIT:
1143                         DRM_DEBUG("R300_CMD_WAIT\n");
1144                         r300_cmd_wait(dev_priv, header);
1145                         break;
1146
1147                 case R300_CMD_SCRATCH:
1148                         DRM_DEBUG("R300_CMD_SCRATCH\n");
1149                         ret = r300_scratch(dev_priv, cmdbuf, header);
1150                         if (ret) {
1151                                 DRM_ERROR("r300_scratch failed\n");
1152                                 goto cleanup;
1153                         }
1154                         break;
1155
1156                 case R300_CMD_R500FP:
1157                         if ((dev_priv->flags & RADEON_FAMILY_MASK) < CHIP_RV515) {
1158                                 DRM_ERROR("Calling r500 command on r300 card\n");
1159                                 ret = -EINVAL;
1160                                 goto cleanup;
1161                         }
1162                         DRM_DEBUG("R300_CMD_R500FP\n");
1163                         ret = r300_emit_r500fp(dev_priv, cmdbuf, header);
1164                         if (ret) {
1165                                 DRM_ERROR("r300_emit_r500fp failed\n");
1166                                 goto cleanup;
1167                         }
1168                         break;
1169                 default:
1170                         DRM_ERROR("bad cmd_type %i at %p\n",
1171                                   header.header.cmd_type,
1172                                   cmdbuf->buf - sizeof(header));
1173                         ret = -EINVAL;
1174                         goto cleanup;
1175                 }
1176         }
1177
1178         DRM_DEBUG("END\n");
1179
1180       cleanup:
1181         r300_pacify(dev_priv);
1182
1183         /* We emit the vertex buffer age here, outside the pacifier "brackets"
1184          * for two reasons:
1185          *  (1) This may coalesce multiple age emissions into a single one and
1186          *  (2) more importantly, some chips lock up hard when scratch registers
1187          *      are written inside the pacifier bracket.
1188          */
1189         if (emit_dispatch_age) {
1190                 RING_LOCALS;
1191
1192                 /* Emit the vertex buffer age */
1193                 BEGIN_RING(2);
1194                 RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch);
1195                 ADVANCE_RING();
1196         }
1197
1198         COMMIT_RING();
1199
1200         return ret;
1201 }