X-Git-Url: http://git.cascardo.info/?a=blobdiff_plain;f=drivers%2Fchar%2Fdrm%2Fsavage_state.c;h=ef2581d16146de03a6b9e717b9ba701490918038;hb=05668381140309088443bf5dc53add4104610fbb;hp=475695a00083b28c60c35d5824c9052eecf73e65;hpb=ddbf9ef385bfbef897210733abfb73cb9b94ecec;p=cascardo%2Flinux.git diff --git a/drivers/char/drm/savage_state.c b/drivers/char/drm/savage_state.c index 475695a00083..ef2581d16146 100644 --- a/drivers/char/drm/savage_state.c +++ b/drivers/char/drm/savage_state.c @@ -26,48 +26,48 @@ #include "savage_drm.h" #include "savage_drv.h" -void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv, - drm_clip_rect_t *pbox) +void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv, + const drm_clip_rect_t * pbox) { uint32_t scstart = dev_priv->state.s3d.new_scstart; - uint32_t scend = dev_priv->state.s3d.new_scend; + uint32_t scend = dev_priv->state.s3d.new_scend; scstart = (scstart & ~SAVAGE_SCISSOR_MASK_S3D) | - ((uint32_t)pbox->x1 & 0x000007ff) | - (((uint32_t)pbox->y1 << 16) & 0x07ff0000); - scend = (scend & ~SAVAGE_SCISSOR_MASK_S3D) | - (((uint32_t)pbox->x2-1) & 0x000007ff) | - ((((uint32_t)pbox->y2-1) << 16) & 0x07ff0000); + ((uint32_t) pbox->x1 & 0x000007ff) | + (((uint32_t) pbox->y1 << 16) & 0x07ff0000); + scend = (scend & ~SAVAGE_SCISSOR_MASK_S3D) | + (((uint32_t) pbox->x2 - 1) & 0x000007ff) | + ((((uint32_t) pbox->y2 - 1) << 16) & 0x07ff0000); if (scstart != dev_priv->state.s3d.scstart || - scend != dev_priv->state.s3d.scend) { + scend != dev_priv->state.s3d.scend) { DMA_LOCALS; BEGIN_DMA(4); - DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D); + DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D); DMA_SET_REGISTERS(SAVAGE_SCSTART_S3D, 2); DMA_WRITE(scstart); DMA_WRITE(scend); dev_priv->state.s3d.scstart = scstart; - dev_priv->state.s3d.scend = scend; + dev_priv->state.s3d.scend = scend; dev_priv->waiting = 1; DMA_COMMIT(); } } -void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv, - drm_clip_rect_t *pbox) +void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv, + const drm_clip_rect_t * pbox) { uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0; uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1; drawctrl0 = (drawctrl0 & ~SAVAGE_SCISSOR_MASK_S4) | - ((uint32_t)pbox->x1 & 0x000007ff) | - (((uint32_t)pbox->y1 << 12) & 0x00fff000); + ((uint32_t) pbox->x1 & 0x000007ff) | + (((uint32_t) pbox->y1 << 12) & 0x00fff000); drawctrl1 = (drawctrl1 & ~SAVAGE_SCISSOR_MASK_S4) | - (((uint32_t)pbox->x2-1) & 0x000007ff) | - ((((uint32_t)pbox->y2-1) << 12) & 0x00fff000); + (((uint32_t) pbox->x2 - 1) & 0x000007ff) | + ((((uint32_t) pbox->y2 - 1) << 12) & 0x00fff000); if (drawctrl0 != dev_priv->state.s4.drawctrl0 || drawctrl1 != dev_priv->state.s4.drawctrl1) { DMA_LOCALS; BEGIN_DMA(4); - DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D); + DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D); DMA_SET_REGISTERS(SAVAGE_DRAWCTRL0_S4, 2); DMA_WRITE(drawctrl0); DMA_WRITE(drawctrl1); @@ -78,22 +78,23 @@ void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv, } } -static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit, +static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit, uint32_t addr) { - if ((addr & 6) != 2) { /* reserved bits */ + if ((addr & 6) != 2) { /* reserved bits */ DRM_ERROR("bad texAddr%d %08x (reserved bits)\n", unit, addr); return DRM_ERR(EINVAL); } - if (!(addr & 1)) { /* local */ + if (!(addr & 1)) { /* local */ addr &= ~7; - if (addr < dev_priv->texture_offset || - addr >= dev_priv->texture_offset+dev_priv->texture_size) { - DRM_ERROR("bad texAddr%d %08x (local addr out of range)\n", - unit, addr); + if (addr < dev_priv->texture_offset || + addr >= dev_priv->texture_offset + dev_priv->texture_size) { + DRM_ERROR + ("bad texAddr%d %08x (local addr out of range)\n", + unit, addr); return DRM_ERR(EINVAL); } - } else { /* AGP */ + } else { /* AGP */ if (!dev_priv->agp_textures) { DRM_ERROR("bad texAddr%d %08x (AGP not available)\n", unit, addr); @@ -103,8 +104,9 @@ static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit, if (addr < dev_priv->agp_textures->offset || addr >= (dev_priv->agp_textures->offset + dev_priv->agp_textures->size)) { - DRM_ERROR("bad texAddr%d %08x (AGP addr out of range)\n", - unit, addr); + DRM_ERROR + ("bad texAddr%d %08x (AGP addr out of range)\n", + unit, addr); return DRM_ERR(EINVAL); } } @@ -113,23 +115,24 @@ static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit, #define SAVE_STATE(reg,where) \ if(start <= reg && start+count > reg) \ - DRM_GET_USER_UNCHECKED(dev_priv->state.where, ®s[reg-start]) + dev_priv->state.where = regs[reg - start] #define SAVE_STATE_MASK(reg,where,mask) do { \ if(start <= reg && start+count > reg) { \ uint32_t tmp; \ - DRM_GET_USER_UNCHECKED(tmp, ®s[reg-start]); \ + tmp = regs[reg - start]; \ dev_priv->state.where = (tmp & (mask)) | \ (dev_priv->state.where & ~(mask)); \ } \ } while (0) -static int savage_verify_state_s3d(drm_savage_private_t *dev_priv, + +static int savage_verify_state_s3d(drm_savage_private_t * dev_priv, unsigned int start, unsigned int count, - const uint32_t __user *regs) + const uint32_t *regs) { if (start < SAVAGE_TEXPALADDR_S3D || - start+count-1 > SAVAGE_DESTTEXRWWATERMARK_S3D) { + start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) { DRM_ERROR("invalid register range (0x%04x-0x%04x)\n", - start, start+count-1); + start, start + count - 1); return DRM_ERR(EINVAL); } @@ -140,28 +143,28 @@ static int savage_verify_state_s3d(drm_savage_private_t *dev_priv, /* if any texture regs were changed ... */ if (start <= SAVAGE_TEXCTRL_S3D && - start+count > SAVAGE_TEXPALADDR_S3D) { + start + count > SAVAGE_TEXPALADDR_S3D) { /* ... check texture state */ SAVE_STATE(SAVAGE_TEXCTRL_S3D, s3d.texctrl); SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr); if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK) - return savage_verify_texaddr( - dev_priv, 0, dev_priv->state.s3d.texaddr); + return savage_verify_texaddr(dev_priv, 0, + dev_priv->state.s3d.texaddr); } return 0; } -static int savage_verify_state_s4(drm_savage_private_t *dev_priv, +static int savage_verify_state_s4(drm_savage_private_t * dev_priv, unsigned int start, unsigned int count, - const uint32_t __user *regs) + const uint32_t *regs) { int ret = 0; if (start < SAVAGE_DRAWLOCALCTRL_S4 || - start+count-1 > SAVAGE_TEXBLENDCOLOR_S4) { + start + count - 1 > SAVAGE_TEXBLENDCOLOR_S4) { DRM_ERROR("invalid register range (0x%04x-0x%04x)\n", - start, start+count-1); + start, start + count - 1); return DRM_ERR(EINVAL); } @@ -172,27 +175,28 @@ static int savage_verify_state_s4(drm_savage_private_t *dev_priv, /* if any texture regs were changed ... */ if (start <= SAVAGE_TEXDESCR_S4 && - start+count > SAVAGE_TEXPALADDR_S4) { + start + count > SAVAGE_TEXPALADDR_S4) { /* ... check texture state */ SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr); SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0); SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1); if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK) - ret |= savage_verify_texaddr( - dev_priv, 0, dev_priv->state.s4.texaddr0); + ret |= savage_verify_texaddr(dev_priv, 0, + dev_priv->state.s4.texaddr0); if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK) - ret |= savage_verify_texaddr( - dev_priv, 1, dev_priv->state.s4.texaddr1); + ret |= savage_verify_texaddr(dev_priv, 1, + dev_priv->state.s4.texaddr1); } return ret; } + #undef SAVE_STATE #undef SAVE_STATE_MASK -static int savage_dispatch_state(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const uint32_t __user *regs) +static int savage_dispatch_state(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const uint32_t *regs) { unsigned int count = cmd_header->state.count; unsigned int start = cmd_header->state.start; @@ -204,23 +208,20 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv, if (!count) return 0; - if (DRM_VERIFYAREA_READ(regs, count*4)) - return DRM_ERR(EFAULT); - if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { ret = savage_verify_state_s3d(dev_priv, start, count, regs); if (ret != 0) return ret; /* scissor regs are emitted in savage_dispatch_draw */ if (start < SAVAGE_SCSTART_S3D) { - if (start+count > SAVAGE_SCEND_S3D+1) - count2 = count - (SAVAGE_SCEND_S3D+1 - start); - if (start+count > SAVAGE_SCSTART_S3D) + if (start + count > SAVAGE_SCEND_S3D + 1) + count2 = count - (SAVAGE_SCEND_S3D + 1 - start); + if (start + count > SAVAGE_SCSTART_S3D) count = SAVAGE_SCSTART_S3D - start; } else if (start <= SAVAGE_SCEND_S3D) { - if (start+count > SAVAGE_SCEND_S3D+1) { - count -= SAVAGE_SCEND_S3D+1 - start; - start = SAVAGE_SCEND_S3D+1; + if (start + count > SAVAGE_SCEND_S3D + 1) { + count -= SAVAGE_SCEND_S3D + 1 - start; + start = SAVAGE_SCEND_S3D + 1; } else return 0; } @@ -230,23 +231,24 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv, return ret; /* scissor regs are emitted in savage_dispatch_draw */ if (start < SAVAGE_DRAWCTRL0_S4) { - if (start+count > SAVAGE_DRAWCTRL1_S4+1) - count2 = count - (SAVAGE_DRAWCTRL1_S4+1 - start); - if (start+count > SAVAGE_DRAWCTRL0_S4) + if (start + count > SAVAGE_DRAWCTRL1_S4 + 1) + count2 = count - + (SAVAGE_DRAWCTRL1_S4 + 1 - start); + if (start + count > SAVAGE_DRAWCTRL0_S4) count = SAVAGE_DRAWCTRL0_S4 - start; } else if (start <= SAVAGE_DRAWCTRL1_S4) { - if (start+count > SAVAGE_DRAWCTRL1_S4+1) { - count -= SAVAGE_DRAWCTRL1_S4+1 - start; - start = SAVAGE_DRAWCTRL1_S4+1; + if (start + count > SAVAGE_DRAWCTRL1_S4 + 1) { + count -= SAVAGE_DRAWCTRL1_S4 + 1 - start; + start = SAVAGE_DRAWCTRL1_S4 + 1; } else return 0; } } - bci_size = count + (count+254)/255 + count2 + (count2+254)/255; + bci_size = count + (count + 254) / 255 + count2 + (count2 + 254) / 255; if (cmd_header->state.global) { - BEGIN_DMA(bci_size+1); + BEGIN_DMA(bci_size + 1); DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D); dev_priv->waiting = 1; } else { @@ -257,7 +259,7 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv, while (count > 0) { unsigned int n = count < 255 ? count : 255; DMA_SET_REGISTERS(start, n); - DMA_COPY_FROM_USER(regs, n); + DMA_COPY(regs, n); count -= n; start += n; regs += n; @@ -273,9 +275,9 @@ static int savage_dispatch_state(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const drm_buf_t *dmabuf) +static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const drm_buf_t * dmabuf) { unsigned char reorder = 0; unsigned int prim = cmd_header->prim.prim; @@ -286,8 +288,8 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, BCI_LOCALS; if (!dmabuf) { - DRM_ERROR("called without dma buffers!\n"); - return DRM_ERR(EINVAL); + DRM_ERROR("called without dma buffers!\n"); + return DRM_ERR(EINVAL); } if (!n) @@ -307,8 +309,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, case SAVAGE_PRIM_TRISTRIP: case SAVAGE_PRIM_TRIFAN: if (n < 3) { - DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n", - n); + DRM_ERROR + ("wrong number of vertices %u in TRIFAN/STRIP\n", + n); return DRM_ERR(EINVAL); } break; @@ -319,17 +322,15 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { if (skip != 0) { - DRM_ERROR("invalid skip flags 0x%04x for DMA\n", - skip); + DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip); return DRM_ERR(EINVAL); } } else { unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) - - (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) - - (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1); + (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) - + (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1); if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) { - DRM_ERROR("invalid skip flags 0x%04x for DMA\n", - skip); + DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip); return DRM_ERR(EINVAL); } if (reorder) { @@ -338,9 +339,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, } } - if (start + n > dmabuf->total/32) { + if (start + n > dmabuf->total / 32) { DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n", - start, start + n - 1, dmabuf->total/32); + start, start + n - 1, dmabuf->total / 32); return DRM_ERR(EINVAL); } @@ -375,32 +376,33 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, /* Need to reorder indices for correct flat * shading while preserving the clock sense * for correct culling. Only on Savage3D. */ - int reorder[3] = {-1, -1, -1}; - reorder[start%3] = 2; + int reorder[3] = { -1, -1, -1 }; + reorder[start % 3] = 2; - BEGIN_BCI((count+1+1)/2); - BCI_DRAW_INDICES_S3D(count, prim, start+2); + BEGIN_BCI((count + 1 + 1) / 2); + BCI_DRAW_INDICES_S3D(count, prim, start + 2); - for (i = start+1; i+1 < start+count; i += 2) + for (i = start + 1; i + 1 < start + count; i += 2) BCI_WRITE((i + reorder[i % 3]) | - ((i+1 + reorder[(i+1) % 3]) << 16)); - if (i < start+count) - BCI_WRITE(i + reorder[i%3]); + ((i + 1 + + reorder[(i + 1) % 3]) << 16)); + if (i < start + count) + BCI_WRITE(i + reorder[i % 3]); } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { - BEGIN_BCI((count+1+1)/2); + BEGIN_BCI((count + 1 + 1) / 2); BCI_DRAW_INDICES_S3D(count, prim, start); - for (i = start+1; i+1 < start+count; i += 2) - BCI_WRITE(i | ((i+1) << 16)); - if (i < start+count) + for (i = start + 1; i + 1 < start + count; i += 2) + BCI_WRITE(i | ((i + 1) << 16)); + if (i < start + count) BCI_WRITE(i); } else { - BEGIN_BCI((count+2+1)/2); + BEGIN_BCI((count + 2 + 1) / 2); BCI_DRAW_INDICES_S4(count, prim, skip); - for (i = start; i+1 < start+count; i += 2) - BCI_WRITE(i | ((i+1) << 16)); - if (i < start+count) + for (i = start; i + 1 < start + count; i += 2) + BCI_WRITE(i | ((i + 1) << 16)); + if (i < start + count) BCI_WRITE(i); } @@ -413,10 +415,9 @@ static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const uint32_t __user *vtxbuf, - unsigned int vb_size, +static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const uint32_t *vtxbuf, unsigned int vb_size, unsigned int vb_stride) { unsigned char reorder = 0; @@ -445,8 +446,9 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, case SAVAGE_PRIM_TRISTRIP: case SAVAGE_PRIM_TRIFAN: if (n < 3) { - DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n", - n); + DRM_ERROR + ("wrong number of vertices %u in TRIFAN/STRIP\n", + n); return DRM_ERR(EINVAL); } break; @@ -460,18 +462,18 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, DRM_ERROR("invalid skip flags 0x%04x\n", skip); return DRM_ERR(EINVAL); } - vtx_size = 8; /* full vertex */ + vtx_size = 8; /* full vertex */ } else { if (skip > SAVAGE_SKIP_ALL_S4) { DRM_ERROR("invalid skip flags 0x%04x\n", skip); return DRM_ERR(EINVAL); } - vtx_size = 10; /* full vertex */ + vtx_size = 10; /* full vertex */ } vtx_size -= (skip & 1) + (skip >> 1 & 1) + - (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) + - (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1); + (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) + + (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1); if (vtx_size > vb_stride) { DRM_ERROR("vertex size greater than vb stride (%u > %u)\n", @@ -479,9 +481,9 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, return DRM_ERR(EINVAL); } - if (start + n > vb_size / (vb_stride*4)) { + if (start + n > vb_size / (vb_stride * 4)) { DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n", - start, start + n - 1, vb_size / (vb_stride*4)); + start, start + n - 1, vb_size / (vb_stride * 4)); return DRM_ERR(EINVAL); } @@ -493,31 +495,29 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, /* Need to reorder vertices for correct flat * shading while preserving the clock sense * for correct culling. Only on Savage3D. */ - int reorder[3] = {-1, -1, -1}; - reorder[start%3] = 2; + int reorder[3] = { -1, -1, -1 }; + reorder[start % 3] = 2; - BEGIN_DMA(count*vtx_size+1); + BEGIN_DMA(count * vtx_size + 1); DMA_DRAW_PRIMITIVE(count, prim, skip); - for (i = start; i < start+count; ++i) { + for (i = start; i < start + count; ++i) { unsigned int j = i + reorder[i % 3]; - DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j], - vtx_size); + DMA_COPY(&vtxbuf[vb_stride * j], vtx_size); } DMA_COMMIT(); } else { - BEGIN_DMA(count*vtx_size+1); + BEGIN_DMA(count * vtx_size + 1); DMA_DRAW_PRIMITIVE(count, prim, skip); if (vb_stride == vtx_size) { - DMA_COPY_FROM_USER(&vtxbuf[vb_stride*start], - vtx_size*count); + DMA_COPY(&vtxbuf[vb_stride * start], + vtx_size * count); } else { - for (i = start; i < start+count; ++i) { - DMA_COPY_FROM_USER( - &vtxbuf[vb_stride*i], - vtx_size); + for (i = start; i < start + count; ++i) { + DMA_COPY(&vtxbuf [vb_stride * i], + vtx_size); } } @@ -533,10 +533,10 @@ static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const uint16_t __user *usr_idx, - const drm_buf_t *dmabuf) +static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const uint16_t *idx, + const drm_buf_t * dmabuf) { unsigned char reorder = 0; unsigned int prim = cmd_header->idx.prim; @@ -546,8 +546,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, BCI_LOCALS; if (!dmabuf) { - DRM_ERROR("called without dma buffers!\n"); - return DRM_ERR(EINVAL); + DRM_ERROR("called without dma buffers!\n"); + return DRM_ERR(EINVAL); } if (!n) @@ -559,16 +559,15 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, prim = SAVAGE_PRIM_TRILIST; case SAVAGE_PRIM_TRILIST: if (n % 3 != 0) { - DRM_ERROR("wrong number of indices %u in TRILIST\n", - n); + DRM_ERROR("wrong number of indices %u in TRILIST\n", n); return DRM_ERR(EINVAL); } break; case SAVAGE_PRIM_TRISTRIP: case SAVAGE_PRIM_TRIFAN: if (n < 3) { - DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n", - n); + DRM_ERROR + ("wrong number of indices %u in TRIFAN/STRIP\n", n); return DRM_ERR(EINVAL); } break; @@ -579,17 +578,15 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { if (skip != 0) { - DRM_ERROR("invalid skip flags 0x%04x for DMA\n", - skip); + DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip); return DRM_ERR(EINVAL); } } else { unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) - - (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) - - (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1); + (skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) - + (skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1); if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) { - DRM_ERROR("invalid skip flags 0x%04x for DMA\n", - skip); + DRM_ERROR("invalid skip flags 0x%04x for DMA\n", skip); return DRM_ERR(EINVAL); } if (reorder) { @@ -625,15 +622,12 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, while (n != 0) { /* Can emit up to 255 indices (85 triangles) at once. */ unsigned int count = n > 255 ? 255 : n; - /* Is it ok to allocate 510 bytes on the stack in an ioctl? */ - uint16_t idx[255]; - /* Copy and check indices */ - DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2); + /* check indices */ for (i = 0; i < count; ++i) { - if (idx[i] > dmabuf->total/32) { + if (idx[i] > dmabuf->total / 32) { DRM_ERROR("idx[%u]=%u out of range (0-%u)\n", - i, idx[i], dmabuf->total/32); + i, idx[i], dmabuf->total / 32); return DRM_ERR(EINVAL); } } @@ -642,35 +636,36 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, /* Need to reorder indices for correct flat * shading while preserving the clock sense * for correct culling. Only on Savage3D. */ - int reorder[3] = {2, -1, -1}; + int reorder[3] = { 2, -1, -1 }; - BEGIN_BCI((count+1+1)/2); + BEGIN_BCI((count + 1 + 1) / 2); BCI_DRAW_INDICES_S3D(count, prim, idx[2]); - for (i = 1; i+1 < count; i += 2) + for (i = 1; i + 1 < count; i += 2) BCI_WRITE(idx[i + reorder[i % 3]] | - (idx[i+1 + reorder[(i+1) % 3]] << 16)); + (idx[i + 1 + + reorder[(i + 1) % 3]] << 16)); if (i < count) - BCI_WRITE(idx[i + reorder[i%3]]); + BCI_WRITE(idx[i + reorder[i % 3]]); } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { - BEGIN_BCI((count+1+1)/2); + BEGIN_BCI((count + 1 + 1) / 2); BCI_DRAW_INDICES_S3D(count, prim, idx[0]); - for (i = 1; i+1 < count; i += 2) - BCI_WRITE(idx[i] | (idx[i+1] << 16)); + for (i = 1; i + 1 < count; i += 2) + BCI_WRITE(idx[i] | (idx[i + 1] << 16)); if (i < count) BCI_WRITE(idx[i]); } else { - BEGIN_BCI((count+2+1)/2); + BEGIN_BCI((count + 2 + 1) / 2); BCI_DRAW_INDICES_S4(count, prim, skip); - for (i = 0; i+1 < count; i += 2) - BCI_WRITE(idx[i] | (idx[i+1] << 16)); + for (i = 0; i + 1 < count; i += 2) + BCI_WRITE(idx[i] | (idx[i + 1] << 16)); if (i < count) BCI_WRITE(idx[i]); } - usr_idx += count; + idx += count; n -= count; prim |= BCI_CMD_DRAW_CONT; @@ -679,12 +674,11 @@ static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const uint16_t __user *usr_idx, - const uint32_t __user *vtxbuf, - unsigned int vb_size, - unsigned int vb_stride) +static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const uint16_t *idx, + const uint32_t *vtxbuf, + unsigned int vb_size, unsigned int vb_stride) { unsigned char reorder = 0; unsigned int prim = cmd_header->idx.prim; @@ -703,16 +697,15 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, prim = SAVAGE_PRIM_TRILIST; case SAVAGE_PRIM_TRILIST: if (n % 3 != 0) { - DRM_ERROR("wrong number of indices %u in TRILIST\n", - n); + DRM_ERROR("wrong number of indices %u in TRILIST\n", n); return DRM_ERR(EINVAL); } break; case SAVAGE_PRIM_TRISTRIP: case SAVAGE_PRIM_TRIFAN: if (n < 3) { - DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n", - n); + DRM_ERROR + ("wrong number of indices %u in TRIFAN/STRIP\n", n); return DRM_ERR(EINVAL); } break; @@ -726,18 +719,18 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, DRM_ERROR("invalid skip flags 0x%04x\n", skip); return DRM_ERR(EINVAL); } - vtx_size = 8; /* full vertex */ + vtx_size = 8; /* full vertex */ } else { if (skip > SAVAGE_SKIP_ALL_S4) { DRM_ERROR("invalid skip flags 0x%04x\n", skip); return DRM_ERR(EINVAL); } - vtx_size = 10; /* full vertex */ + vtx_size = 10; /* full vertex */ } vtx_size -= (skip & 1) + (skip >> 1 & 1) + - (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) + - (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1); + (skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) + + (skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1); if (vtx_size > vb_stride) { DRM_ERROR("vertex size greater than vb stride (%u > %u)\n", @@ -749,15 +742,12 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, while (n != 0) { /* Can emit up to 255 vertices (85 triangles) at once. */ unsigned int count = n > 255 ? 255 : n; - /* Is it ok to allocate 510 bytes on the stack in an ioctl? */ - uint16_t idx[255]; - - /* Copy and check indices */ - DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2); + + /* Check indices */ for (i = 0; i < count; ++i) { - if (idx[i] > vb_size / (vb_stride*4)) { + if (idx[i] > vb_size / (vb_stride * 4)) { DRM_ERROR("idx[%u]=%u out of range (0-%u)\n", - i, idx[i], vb_size / (vb_stride*4)); + i, idx[i], vb_size / (vb_stride * 4)); return DRM_ERR(EINVAL); } } @@ -766,32 +756,30 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, /* Need to reorder vertices for correct flat * shading while preserving the clock sense * for correct culling. Only on Savage3D. */ - int reorder[3] = {2, -1, -1}; + int reorder[3] = { 2, -1, -1 }; - BEGIN_DMA(count*vtx_size+1); + BEGIN_DMA(count * vtx_size + 1); DMA_DRAW_PRIMITIVE(count, prim, skip); for (i = 0; i < count; ++i) { unsigned int j = idx[i + reorder[i % 3]]; - DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j], - vtx_size); + DMA_COPY(&vtxbuf[vb_stride * j], vtx_size); } DMA_COMMIT(); } else { - BEGIN_DMA(count*vtx_size+1); + BEGIN_DMA(count * vtx_size + 1); DMA_DRAW_PRIMITIVE(count, prim, skip); for (i = 0; i < count; ++i) { unsigned int j = idx[i]; - DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j], - vtx_size); + DMA_COPY(&vtxbuf[vb_stride * j], vtx_size); } DMA_COMMIT(); } - usr_idx += count; + idx += count; n -= count; prim |= BCI_CMD_DRAW_CONT; @@ -800,13 +788,13 @@ static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_clear(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t *cmd_header, - const drm_savage_cmd_header_t __user *data, +static int savage_dispatch_clear(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t * cmd_header, + const drm_savage_cmd_header_t *data, unsigned int nbox, - const drm_clip_rect_t __user *usr_boxes) + const drm_clip_rect_t *boxes) { - unsigned int flags = cmd_header->clear0.flags, mask, value; + unsigned int flags = cmd_header->clear0.flags; unsigned int clear_cmd; unsigned int i, nbufs; DMA_LOCALS; @@ -814,42 +802,34 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv, if (nbox == 0) return 0; - DRM_GET_USER_UNCHECKED(mask, &((const drm_savage_cmd_header_t*)data) - ->clear1.mask); - DRM_GET_USER_UNCHECKED(value, &((const drm_savage_cmd_header_t*)data) - ->clear1.value); - clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP | - BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW; - BCI_CMD_SET_ROP(clear_cmd,0xCC); + BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW; + BCI_CMD_SET_ROP(clear_cmd, 0xCC); nbufs = ((flags & SAVAGE_FRONT) ? 1 : 0) + - ((flags & SAVAGE_BACK) ? 1 : 0) + - ((flags & SAVAGE_DEPTH) ? 1 : 0); + ((flags & SAVAGE_BACK) ? 1 : 0) + ((flags & SAVAGE_DEPTH) ? 1 : 0); if (nbufs == 0) return 0; - if (mask != 0xffffffff) { + if (data->clear1.mask != 0xffffffff) { /* set mask */ BEGIN_DMA(2); DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1); - DMA_WRITE(mask); + DMA_WRITE(data->clear1.mask); DMA_COMMIT(); } for (i = 0; i < nbox; ++i) { - drm_clip_rect_t box; unsigned int x, y, w, h; unsigned int buf; - DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box)); - x = box.x1, y = box.y1; - w = box.x2 - box.x1; - h = box.y2 - box.y1; - BEGIN_DMA(nbufs*6); + x = boxes[i].x1, y = boxes[i].y1; + w = boxes[i].x2 - boxes[i].x1; + h = boxes[i].y2 - boxes[i].y1; + BEGIN_DMA(nbufs * 6); for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) { if (!(flags & buf)) continue; DMA_WRITE(clear_cmd); - switch(buf) { + switch (buf) { case SAVAGE_FRONT: DMA_WRITE(dev_priv->front_offset); DMA_WRITE(dev_priv->front_bd); @@ -863,13 +843,13 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv, DMA_WRITE(dev_priv->depth_bd); break; } - DMA_WRITE(value); + DMA_WRITE(data->clear1.value); DMA_WRITE(BCI_X_Y(x, y)); DMA_WRITE(BCI_W_H(w, h)); } DMA_COMMIT(); } - if (mask != 0xffffffff) { + if (data->clear1.mask != 0xffffffff) { /* reset mask */ BEGIN_DMA(2); DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1); @@ -880,9 +860,8 @@ static int savage_dispatch_clear(drm_savage_private_t *dev_priv, return 0; } -static int savage_dispatch_swap(drm_savage_private_t *dev_priv, - unsigned int nbox, - const drm_clip_rect_t __user *usr_boxes) +static int savage_dispatch_swap(drm_savage_private_t * dev_priv, + unsigned int nbox, const drm_clip_rect_t *boxes) { unsigned int swap_cmd; unsigned int i; @@ -892,50 +871,45 @@ static int savage_dispatch_swap(drm_savage_private_t *dev_priv, return 0; swap_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP | - BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD; - BCI_CMD_SET_ROP(swap_cmd,0xCC); + BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD; + BCI_CMD_SET_ROP(swap_cmd, 0xCC); for (i = 0; i < nbox; ++i) { - drm_clip_rect_t box; - DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box)); - BEGIN_DMA(6); DMA_WRITE(swap_cmd); DMA_WRITE(dev_priv->back_offset); DMA_WRITE(dev_priv->back_bd); - DMA_WRITE(BCI_X_Y(box.x1, box.y1)); - DMA_WRITE(BCI_X_Y(box.x1, box.y1)); - DMA_WRITE(BCI_W_H(box.x2-box.x1, box.y2-box.y1)); + DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1)); + DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1)); + DMA_WRITE(BCI_W_H(boxes[i].x2 - boxes[i].x1, + boxes[i].y2 - boxes[i].y1)); DMA_COMMIT(); } return 0; } -static int savage_dispatch_draw(drm_savage_private_t *dev_priv, - const drm_savage_cmd_header_t __user *start, - const drm_savage_cmd_header_t __user *end, - const drm_buf_t *dmabuf, - const unsigned int __user *usr_vtxbuf, +static int savage_dispatch_draw(drm_savage_private_t * dev_priv, + const drm_savage_cmd_header_t *start, + const drm_savage_cmd_header_t *end, + const drm_buf_t * dmabuf, + const unsigned int *vtxbuf, unsigned int vb_size, unsigned int vb_stride, unsigned int nbox, - const drm_clip_rect_t __user *usr_boxes) + const drm_clip_rect_t *boxes) { unsigned int i, j; int ret; for (i = 0; i < nbox; ++i) { - drm_clip_rect_t box; - const drm_savage_cmd_header_t __user *usr_cmdbuf; - DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box)); - dev_priv->emit_clip_rect(dev_priv, &box); + const drm_savage_cmd_header_t *cmdbuf; + dev_priv->emit_clip_rect(dev_priv, &boxes[i]); - usr_cmdbuf = start; - while (usr_cmdbuf < end) { + cmdbuf = start; + while (cmdbuf < end) { drm_savage_cmd_header_t cmd_header; - DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf, - sizeof(cmd_header)); - usr_cmdbuf++; + cmd_header = *cmdbuf; + cmdbuf++; switch (cmd_header.cmd.cmd) { case SAVAGE_CMD_DMA_PRIM: ret = savage_dispatch_dma_prim( @@ -944,27 +918,24 @@ static int savage_dispatch_draw(drm_savage_private_t *dev_priv, case SAVAGE_CMD_VB_PRIM: ret = savage_dispatch_vb_prim( dev_priv, &cmd_header, - (const uint32_t __user *)usr_vtxbuf, - vb_size, vb_stride); + vtxbuf, vb_size, vb_stride); break; case SAVAGE_CMD_DMA_IDX: j = (cmd_header.idx.count + 3) / 4; /* j was check in savage_bci_cmdbuf */ - ret = savage_dispatch_dma_idx( - dev_priv, &cmd_header, - (const uint16_t __user *)usr_cmdbuf, + ret = savage_dispatch_dma_idx(dev_priv, + &cmd_header, (const uint16_t *)cmdbuf, dmabuf); - usr_cmdbuf += j; + cmdbuf += j; break; case SAVAGE_CMD_VB_IDX: j = (cmd_header.idx.count + 3) / 4; /* j was check in savage_bci_cmdbuf */ - ret = savage_dispatch_vb_idx( - dev_priv, &cmd_header, - (const uint16_t __user *)usr_cmdbuf, - (const uint32_t __user *)usr_vtxbuf, - vb_size, vb_stride); - usr_cmdbuf += j; + ret = savage_dispatch_vb_idx(dev_priv, + &cmd_header, (const uint16_t *)cmdbuf, + (const uint32_t *)vtxbuf, vb_size, + vb_stride); + cmdbuf += j; break; default: /* What's the best return code? EFAULT? */ @@ -989,24 +960,25 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) drm_device_dma_t *dma = dev->dma; drm_buf_t *dmabuf; drm_savage_cmdbuf_t cmdbuf; - drm_savage_cmd_header_t __user *usr_cmdbuf; - drm_savage_cmd_header_t __user *first_draw_cmd; - unsigned int __user *usr_vtxbuf; - drm_clip_rect_t __user *usr_boxes; + drm_savage_cmd_header_t *kcmd_addr = NULL; + drm_savage_cmd_header_t *first_draw_cmd; + unsigned int *kvb_addr = NULL; + drm_clip_rect_t *kbox_addr = NULL; unsigned int i, j; int ret = 0; DRM_DEBUG("\n"); - + LOCK_TEST_WITH_RETURN(dev, filp); - DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *)data, + DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *) data, sizeof(cmdbuf)); if (dma && dma->buflist) { if (cmdbuf.dma_idx > dma->buf_count) { - DRM_ERROR("vertex buffer index %u out of range (0-%u)\n", - cmdbuf.dma_idx, dma->buf_count-1); + DRM_ERROR + ("vertex buffer index %u out of range (0-%u)\n", + cmdbuf.dma_idx, dma->buf_count - 1); return DRM_ERR(EINVAL); } dmabuf = dma->buflist[cmdbuf.dma_idx]; @@ -1014,15 +986,53 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) dmabuf = NULL; } - usr_cmdbuf = (drm_savage_cmd_header_t __user *)cmdbuf.cmd_addr; - usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr; - usr_boxes = (drm_clip_rect_t __user *)cmdbuf.box_addr; - if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size*8)) || - (cmdbuf.vb_size && DRM_VERIFYAREA_READ( - usr_vtxbuf, cmdbuf.vb_size)) || - (cmdbuf.nbox && DRM_VERIFYAREA_READ( - usr_boxes, cmdbuf.nbox*sizeof(drm_clip_rect_t)))) - return DRM_ERR(EFAULT); + /* Copy the user buffers into kernel temporary areas. This hasn't been + * a performance loss compared to VERIFYAREA_READ/ + * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct + * for locking on FreeBSD. + */ + if (cmdbuf.size) { + kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER); + if (kcmd_addr == NULL) + return ENOMEM; + + if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr, + cmdbuf.size * 8)) + { + drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER); + return DRM_ERR(EFAULT); + } + cmdbuf.cmd_addr = kcmd_addr; + } + if (cmdbuf.vb_size) { + kvb_addr = drm_alloc(cmdbuf.vb_size, DRM_MEM_DRIVER); + if (kvb_addr == NULL) { + ret = DRM_ERR(ENOMEM); + goto done; + } + + if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf.vb_addr, + cmdbuf.vb_size)) { + ret = DRM_ERR(EFAULT); + goto done; + } + cmdbuf.vb_addr = kvb_addr; + } + if (cmdbuf.nbox) { + kbox_addr = drm_alloc(cmdbuf.nbox * sizeof(drm_clip_rect_t), + DRM_MEM_DRIVER); + if (kbox_addr == NULL) { + ret = DRM_ERR(ENOMEM); + goto done; + } + + if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf.box_addr, + cmdbuf.nbox * sizeof(drm_clip_rect_t))) { + ret = DRM_ERR(EFAULT); + goto done; + } + cmdbuf.box_addr = kbox_addr; + } /* Make sure writes to DMA buffers are finished before sending * DMA commands to the graphics hardware. */ @@ -1036,9 +1046,8 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) first_draw_cmd = NULL; while (i < cmdbuf.size) { drm_savage_cmd_header_t cmd_header; - DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf, - sizeof(cmd_header)); - usr_cmdbuf++; + cmd_header = *(drm_savage_cmd_header_t *)cmdbuf.cmd_addr; + cmdbuf.cmd_addr++; i++; /* Group drawing commands with same state to minimize @@ -1058,17 +1067,18 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) case SAVAGE_CMD_DMA_PRIM: case SAVAGE_CMD_VB_PRIM: if (!first_draw_cmd) - first_draw_cmd = usr_cmdbuf-1; - usr_cmdbuf += j; + first_draw_cmd = cmdbuf.cmd_addr - 1; + cmdbuf.cmd_addr += j; i += j; break; default: if (first_draw_cmd) { - ret = savage_dispatch_draw ( - dev_priv, first_draw_cmd, usr_cmdbuf-1, - dmabuf, usr_vtxbuf, cmdbuf.vb_size, - cmdbuf.vb_stride, - cmdbuf.nbox, usr_boxes); + ret = savage_dispatch_draw( + dev_priv, first_draw_cmd, + cmdbuf.cmd_addr - 1, + dmabuf, cmdbuf.vb_addr, cmdbuf.vb_size, + cmdbuf.vb_stride, + cmdbuf.nbox, cmdbuf.box_addr); if (ret != 0) return ret; first_draw_cmd = NULL; @@ -1084,12 +1094,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) DRM_ERROR("command SAVAGE_CMD_STATE extends " "beyond end of command buffer\n"); DMA_FLUSH(); - return DRM_ERR(EINVAL); + ret = DRM_ERR(EINVAL); + goto done; } - ret = savage_dispatch_state( - dev_priv, &cmd_header, - (uint32_t __user *)usr_cmdbuf); - usr_cmdbuf += j; + ret = savage_dispatch_state(dev_priv, &cmd_header, + (const uint32_t *)cmdbuf.cmd_addr); + cmdbuf.cmd_addr += j; i += j; break; case SAVAGE_CMD_CLEAR: @@ -1097,38 +1107,40 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) DRM_ERROR("command SAVAGE_CMD_CLEAR extends " "beyond end of command buffer\n"); DMA_FLUSH(); - return DRM_ERR(EINVAL); + ret = DRM_ERR(EINVAL); + goto done; } ret = savage_dispatch_clear(dev_priv, &cmd_header, - usr_cmdbuf, - cmdbuf.nbox, usr_boxes); - usr_cmdbuf++; + cmdbuf.cmd_addr, + cmdbuf.nbox, cmdbuf.box_addr); + cmdbuf.cmd_addr++; i++; break; case SAVAGE_CMD_SWAP: - ret = savage_dispatch_swap(dev_priv, - cmdbuf.nbox, usr_boxes); + ret = savage_dispatch_swap(dev_priv, cmdbuf.nbox, + cmdbuf.box_addr); break; default: DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd); DMA_FLUSH(); - return DRM_ERR(EINVAL); + ret = DRM_ERR(EINVAL); + goto done; } if (ret != 0) { DMA_FLUSH(); - return ret; + goto done; } } if (first_draw_cmd) { ret = savage_dispatch_draw ( - dev_priv, first_draw_cmd, usr_cmdbuf, dmabuf, - usr_vtxbuf, cmdbuf.vb_size, cmdbuf.vb_stride, - cmdbuf.nbox, usr_boxes); + dev_priv, first_draw_cmd, cmdbuf.cmd_addr, dmabuf, + cmdbuf.vb_addr, cmdbuf.vb_size, cmdbuf.vb_stride, + cmdbuf.nbox, cmdbuf.box_addr); if (ret != 0) { DMA_FLUSH(); - return ret; + goto done; } } @@ -1142,5 +1154,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS) savage_freelist_put(dev, dmabuf); } - return 0; +done: + /* If we didn't need to allocate them, these'll be NULL */ + drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER); + drm_free(kvb_addr, cmdbuf.vb_size, DRM_MEM_DRIVER); + drm_free(kbox_addr, cmdbuf.nbox * sizeof(drm_clip_rect_t), + DRM_MEM_DRIVER); + + return ret; }