1 files changed, 505 insertions, 242 deletions

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 250a3a918193..909bda8dd550 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -50,6 +50,7 @@ struct r600_cs_track {
         u32                     nsamples;
         u32                     cb_color_base_last[8];
         struct radeon_bo        *cb_color_bo[8];
+        u64                     cb_color_bo_mc[8];
         u32                     cb_color_bo_offset[8];
         struct radeon_bo        *cb_color_frag_bo[8];
         struct radeon_bo        *cb_color_tile_bo[8];
@@ -67,76 +68,239 @@ struct r600_cs_track {
         u32                     db_depth_size;
         u32                     db_offset;
         struct radeon_bo        *db_bo;
+        u64                     db_bo_mc;
 };
 
+#define FMT_8_BIT(fmt, vc)   [fmt] = { 1, 1, 1, vc, CHIP_R600 }
+#define FMT_16_BIT(fmt, vc)  [fmt] = { 1, 1, 2, vc, CHIP_R600 }
+#define FMT_24_BIT(fmt)      [fmt] = { 1, 1, 3,  0, CHIP_R600 }
+#define FMT_32_BIT(fmt, vc)  [fmt] = { 1, 1, 4, vc, CHIP_R600 }
+#define FMT_48_BIT(fmt)      [fmt] = { 1, 1, 6,  0, CHIP_R600 }
+#define FMT_64_BIT(fmt, vc)  [fmt] = { 1, 1, 8, vc, CHIP_R600 }
+#define FMT_96_BIT(fmt)      [fmt] = { 1, 1, 12, 0, CHIP_R600 }
+#define FMT_128_BIT(fmt, vc) [fmt] = { 1, 1, 16,vc, CHIP_R600 }
+
+struct gpu_formats {
+        unsigned blockwidth;
+        unsigned blockheight;
+        unsigned blocksize;
+        unsigned valid_color;
+        enum radeon_family min_family;
+};
+
+static const struct gpu_formats color_formats_table[] = {
+        /* 8 bit */
+        FMT_8_BIT(V_038004_COLOR_8, 1),
+        FMT_8_BIT(V_038004_COLOR_4_4, 1),
+        FMT_8_BIT(V_038004_COLOR_3_3_2, 1),
+        FMT_8_BIT(V_038004_FMT_1, 0),
+
+        /* 16-bit */
+        FMT_16_BIT(V_038004_COLOR_16, 1),
+        FMT_16_BIT(V_038004_COLOR_16_FLOAT, 1),
+        FMT_16_BIT(V_038004_COLOR_8_8, 1),
+        FMT_16_BIT(V_038004_COLOR_5_6_5, 1),
+        FMT_16_BIT(V_038004_COLOR_6_5_5, 1),
+        FMT_16_BIT(V_038004_COLOR_1_5_5_5, 1),
+        FMT_16_BIT(V_038004_COLOR_4_4_4_4, 1),
+        FMT_16_BIT(V_038004_COLOR_5_5_5_1, 1),
+
+        /* 24-bit */
+        FMT_24_BIT(V_038004_FMT_8_8_8),
+                                               
+        /* 32-bit */
+        FMT_32_BIT(V_038004_COLOR_32, 1),
+        FMT_32_BIT(V_038004_COLOR_32_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_16_16, 1),
+        FMT_32_BIT(V_038004_COLOR_16_16_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_8_24, 1),
+        FMT_32_BIT(V_038004_COLOR_8_24_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_24_8, 1),
+        FMT_32_BIT(V_038004_COLOR_24_8_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_10_11_11, 1),
+        FMT_32_BIT(V_038004_COLOR_10_11_11_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_11_11_10, 1),
+        FMT_32_BIT(V_038004_COLOR_11_11_10_FLOAT, 1),
+        FMT_32_BIT(V_038004_COLOR_2_10_10_10, 1),
+        FMT_32_BIT(V_038004_COLOR_8_8_8_8, 1),
+        FMT_32_BIT(V_038004_COLOR_10_10_10_2, 1),
+        FMT_32_BIT(V_038004_FMT_5_9_9_9_SHAREDEXP, 0),
+        FMT_32_BIT(V_038004_FMT_32_AS_8, 0),
+        FMT_32_BIT(V_038004_FMT_32_AS_8_8, 0),
+
+        /* 48-bit */
+        FMT_48_BIT(V_038004_FMT_16_16_16),
+        FMT_48_BIT(V_038004_FMT_16_16_16_FLOAT),
+
+        /* 64-bit */
+        FMT_64_BIT(V_038004_COLOR_X24_8_32_FLOAT, 1),
+        FMT_64_BIT(V_038004_COLOR_32_32, 1),
+        FMT_64_BIT(V_038004_COLOR_32_32_FLOAT, 1),
+        FMT_64_BIT(V_038004_COLOR_16_16_16_16, 1),
+        FMT_64_BIT(V_038004_COLOR_16_16_16_16_FLOAT, 1),
+
+        FMT_96_BIT(V_038004_FMT_32_32_32),
+        FMT_96_BIT(V_038004_FMT_32_32_32_FLOAT),
+
+        /* 128-bit */
+        FMT_128_BIT(V_038004_COLOR_32_32_32_32, 1),
+        FMT_128_BIT(V_038004_COLOR_32_32_32_32_FLOAT, 1),
+
+        [V_038004_FMT_GB_GR] = { 2, 1, 4, 0 },
+        [V_038004_FMT_BG_RG] = { 2, 1, 4, 0 },
+
+        /* block compressed formats */
+        [V_038004_FMT_BC1] = { 4, 4, 8, 0 },
+        [V_038004_FMT_BC2] = { 4, 4, 16, 0 },
+        [V_038004_FMT_BC3] = { 4, 4, 16, 0 },
+        [V_038004_FMT_BC4] = { 4, 4, 8, 0 },
+        [V_038004_FMT_BC5] = { 4, 4, 16, 0},
+        [V_038004_FMT_BC6] = { 4, 4, 16, 0, CHIP_CEDAR}, /* Evergreen-only */
+        [V_038004_FMT_BC7] = { 4, 4, 16, 0, CHIP_CEDAR}, /* Evergreen-only */
+
+        /* The other Evergreen formats */
+        [V_038004_FMT_32_AS_32_32_32_32] = { 1, 1, 4, 0, CHIP_CEDAR},
+};
+
+static inline bool fmt_is_valid_color(u32 format)
+{
+        if (format >= ARRAY_SIZE(color_formats_table))
+                return false;
+        
+        if (color_formats_table[format].valid_color)
+                return true;
+
+        return false;
+}
+
+static inline bool fmt_is_valid_texture(u32 format, enum radeon_family family)
+{
+        if (format >= ARRAY_SIZE(color_formats_table))
+                return false;
+        
+        if (family < color_formats_table[format].min_family)
+                return false;
+
+        if (color_formats_table[format].blockwidth > 0)
+                return true;
+
+        return false;
+}
+
+static inline int fmt_get_blocksize(u32 format)
+{
+        if (format >= ARRAY_SIZE(color_formats_table))
+                return 0;
+
+        return color_formats_table[format].blocksize;
+}
+
+static inline int fmt_get_nblocksx(u32 format, u32 w)
+{
+        unsigned bw;
+
+        if (format >= ARRAY_SIZE(color_formats_table))
+                return 0;
+
+        bw = color_formats_table[format].blockwidth;
+        if (bw == 0)
+                return 0;
+
+        return (w + bw - 1) / bw;
+}
+
+static inline int fmt_get_nblocksy(u32 format, u32 h)
+{
+        unsigned bh;
+
+        if (format >= ARRAY_SIZE(color_formats_table))
+                return 0;
+
+        bh = color_formats_table[format].blockheight;
+        if (bh == 0)
+                return 0;
+
+        return (h + bh - 1) / bh;
+}
+
 static inline int r600_bpe_from_format(u32 *bpe, u32 format)
 {
-        switch (format) {
-        case V_038004_COLOR_8:
-        case V_038004_COLOR_4_4:
-        case V_038004_COLOR_3_3_2:
-        case V_038004_FMT_1:
-                *bpe = 1;
-                break;
-        case V_038004_COLOR_16:
-        case V_038004_COLOR_16_FLOAT:
-        case V_038004_COLOR_8_8:
-        case V_038004_COLOR_5_6_5:
-        case V_038004_COLOR_6_5_5:
-        case V_038004_COLOR_1_5_5_5:
-        case V_038004_COLOR_4_4_4_4:
-        case V_038004_COLOR_5_5_5_1:
-                *bpe = 2;
-                break;
-        case V_038004_FMT_8_8_8:
-                *bpe = 3;
-                break;
-        case V_038004_COLOR_32:
-        case V_038004_COLOR_32_FLOAT:
-        case V_038004_COLOR_16_16:
-        case V_038004_COLOR_16_16_FLOAT:
-        case V_038004_COLOR_8_24:
-        case V_038004_COLOR_8_24_FLOAT:
-        case V_038004_COLOR_24_8:
-        case V_038004_COLOR_24_8_FLOAT:
-        case V_038004_COLOR_10_11_11:
-        case V_038004_COLOR_10_11_11_FLOAT:
-        case V_038004_COLOR_11_11_10:
-        case V_038004_COLOR_11_11_10_FLOAT:
-        case V_038004_COLOR_2_10_10_10:
-        case V_038004_COLOR_8_8_8_8:
-        case V_038004_COLOR_10_10_10_2:
-        case V_038004_FMT_5_9_9_9_SHAREDEXP:
-        case V_038004_FMT_32_AS_8:
-        case V_038004_FMT_32_AS_8_8:
-                *bpe = 4;
-                break;
-        case V_038004_COLOR_X24_8_32_FLOAT:
-        case V_038004_COLOR_32_32:
-        case V_038004_COLOR_32_32_FLOAT:
-        case V_038004_COLOR_16_16_16_16:
-        case V_038004_COLOR_16_16_16_16_FLOAT:
-                *bpe = 8;
+        unsigned res;
+
+        if (format >= ARRAY_SIZE(color_formats_table))
+                goto fail;
+
+        res = color_formats_table[format].blocksize;
+        if (res == 0)
+                goto fail;
+
+        *bpe = res;
+        return 0;
+
+fail:
+        *bpe = 16;
+        return -EINVAL;
+}
+
+struct array_mode_checker {
+        int array_mode;
+        u32 group_size;
+        u32 nbanks;
+        u32 npipes;
+        u32 nsamples;
+        u32 blocksize;
+};
+
+/* returns alignment in pixels for pitch/height/depth and bytes for base */
+static inline int r600_get_array_mode_alignment(struct array_mode_checker *values,
+                                                u32 *pitch_align,
+                                                u32 *height_align,
+                                                u32 *depth_align,
+                                                u64 *base_align)
+{
+        u32 tile_width = 8;
+        u32 tile_height = 8;
+        u32 macro_tile_width = values->nbanks;
+        u32 macro_tile_height = values->npipes;
+        u32 tile_bytes = tile_width * tile_height * values->blocksize * values->nsamples;
+        u32 macro_tile_bytes = macro_tile_width * macro_tile_height * tile_bytes;
+
+        switch (values->array_mode) {
+        case ARRAY_LINEAR_GENERAL:
+                /* technically tile_width/_height for pitch/height */
+                *pitch_align = 1; /* tile_width */
+                *height_align = 1; /* tile_height */
+                *depth_align = 1;
+                *base_align = 1;
                 break;
-        case V_038004_FMT_16_16_16:
-        case V_038004_FMT_16_16_16_FLOAT:
-                *bpe = 6;
+        case ARRAY_LINEAR_ALIGNED:
+                *pitch_align = max((u32)64, (u32)(values->group_size / values->blocksize));
+                *height_align = tile_height;
+                *depth_align = 1;
+                *base_align = values->group_size;
                 break;
-        case V_038004_FMT_32_32_32:
-        case V_038004_FMT_32_32_32_FLOAT:
-                *bpe = 12;
+        case ARRAY_1D_TILED_THIN1:
+                *pitch_align = max((u32)tile_width,
+                                   (u32)(values->group_size /
+                                         (tile_height * values->blocksize * values->nsamples)));
+                *height_align = tile_height;
+                *depth_align = 1;
+                *base_align = values->group_size;
                 break;
-        case V_038004_COLOR_32_32_32_32:
-        case V_038004_COLOR_32_32_32_32_FLOAT:
-                *bpe = 16;
+        case ARRAY_2D_TILED_THIN1:
+                *pitch_align = max((u32)macro_tile_width,
+                                  (u32)(((values->group_size / tile_height) /
+                                         (values->blocksize * values->nsamples)) *
+                                        values->nbanks)) * tile_width;
+                *height_align = macro_tile_height * tile_height;
+                *depth_align = 1;
+                *base_align = max(macro_tile_bytes,
+                                  (*pitch_align) * values->blocksize * (*height_align) * values->nsamples);
                 break;
-        case V_038004_FMT_GB_GR:
-        case V_038004_FMT_BG_RG:
-        case V_038004_COLOR_INVALID:
         default:
-                *bpe = 16;
                 return -EINVAL;
         }
+
         return 0;
 }
 
@@ -153,10 +317,12 @@ static void r600_cs_track_init(struct r600_cs_track *track)
                 track->cb_color_info[i] = 0;
                 track->cb_color_bo[i] = NULL;
                 track->cb_color_bo_offset[i] = 0xFFFFFFFF;
+                track->cb_color_bo_mc[i] = 0xFFFFFFFF;
         }
         track->cb_target_mask = 0xFFFFFFFF;
         track->cb_shader_mask = 0xFFFFFFFF;
         track->db_bo = NULL;
+        track->db_bo_mc = 0xFFFFFFFF;
         /* assume the biggest format and that htile is enabled */
         track->db_depth_info = 7 | (1 << 25);
         track->db_depth_view = 0xFFFFC000;
@@ -168,71 +334,59 @@ static void r600_cs_track_init(struct r600_cs_track *track)
 static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
 {
         struct r600_cs_track *track = p->track;
-        u32 bpe = 0, pitch, slice_tile_max, size, tmp, height, pitch_align;
+        u32 slice_tile_max, size, tmp;
+        u32 height, height_align, pitch, pitch_align, depth_align;
+        u64 base_offset, base_align;
+        struct array_mode_checker array_check;
         volatile u32 *ib = p->ib->ptr;
-
+        unsigned array_mode;
+        u32 format;
         if (G_0280A0_TILE_MODE(track->cb_color_info[i])) {
                 dev_warn(p->dev, "FMASK or CMASK buffer are not supported by this kernel\n");
                 return -EINVAL;
         }
         size = radeon_bo_size(track->cb_color_bo[i]) - track->cb_color_bo_offset[i];
-        if (r600_bpe_from_format(&bpe, G_0280A0_FORMAT(track->cb_color_info[i]))) {
+        format = G_0280A0_FORMAT(track->cb_color_info[i]);
+        if (!fmt_is_valid_color(format)) {
                 dev_warn(p->dev, "%s:%d cb invalid format %d for %d (0x%08X)\n",
-                         __func__, __LINE__, G_0280A0_FORMAT(track->cb_color_info[i]),
+                         __func__, __LINE__, format,
                         i, track->cb_color_info[i]);
                 return -EINVAL;
         }
-        /* pitch is the number of 8x8 tiles per row */
-        pitch = G_028060_PITCH_TILE_MAX(track->cb_color_size[i]) + 1;
+        /* pitch in pixels */
+        pitch = (G_028060_PITCH_TILE_MAX(track->cb_color_size[i]) + 1) * 8;
         slice_tile_max = G_028060_SLICE_TILE_MAX(track->cb_color_size[i]) + 1;
-        height = size / (pitch * 8 * bpe);
+        slice_tile_max *= 64;
+        height = slice_tile_max / pitch;
         if (height > 8192)
                 height = 8192;
-        if (height > 7)
-                height &= ~0x7;
-        switch (G_0280A0_ARRAY_MODE(track->cb_color_info[i])) {
+        array_mode = G_0280A0_ARRAY_MODE(track->cb_color_info[i]);
+
+        base_offset = track->cb_color_bo_mc[i] + track->cb_color_bo_offset[i];
+        array_check.array_mode = array_mode;
+        array_check.group_size = track->group_size;
+        array_check.nbanks = track->nbanks;
+        array_check.npipes = track->npipes;
+        array_check.nsamples = track->nsamples;
+        array_check.blocksize = fmt_get_blocksize(format);
+        if (r600_get_array_mode_alignment(&array_check,
+                                          &pitch_align, &height_align, &depth_align, &base_align)) {
+                dev_warn(p->dev, "%s invalid tiling %d for %d (0x%08X)\n", __func__,
+                         G_0280A0_ARRAY_MODE(track->cb_color_info[i]), i,
+                         track->cb_color_info[i]);
+                return -EINVAL;
+        }
+        switch (array_mode) {
         case V_0280A0_ARRAY_LINEAR_GENERAL:
-                /* technically height & 0x7 */
                 break;
         case V_0280A0_ARRAY_LINEAR_ALIGNED:
-                pitch_align = max((u32)64, (u32)(track->group_size / bpe)) / 8;
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d cb pitch (%d) invalid\n",
-                                 __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                if (!IS_ALIGNED(height, 8)) {
-                        dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
-                                 __func__, __LINE__, height);
-                        return -EINVAL;
-                }
                 break;
         case V_0280A0_ARRAY_1D_TILED_THIN1:
-                pitch_align = max((u32)8, (u32)(track->group_size / (8 * bpe * track->nsamples))) / 8;
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d cb pitch (%d) invalid\n",
-                                 __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                if (!IS_ALIGNED(height, 8)) {
-                        dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
-                                 __func__, __LINE__, height);
-                        return -EINVAL;
-                }
+                /* avoid breaking userspace */
+                if (height > 7)
+                        height &= ~0x7;
                 break;
         case V_0280A0_ARRAY_2D_TILED_THIN1:
-                pitch_align = max((u32)track->nbanks,
-                                  (u32)(((track->group_size / 8) / (bpe * track->nsamples)) * track->nbanks));
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d cb pitch (%d) invalid\n",
-                                __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                if (!IS_ALIGNED((height / 8), track->nbanks)) {
-                        dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
-                                 __func__, __LINE__, height);
-                        return -EINVAL;
-                }
                 break;
         default:
                 dev_warn(p->dev, "%s invalid tiling %d for %d (0x%08X)\n", __func__,
@@ -240,21 +394,46 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
                         track->cb_color_info[i]);
                 return -EINVAL;
         }
-        /* check offset */
-        tmp = height * pitch * 8 * bpe;
-        if ((tmp + track->cb_color_bo_offset[i]) > radeon_bo_size(track->cb_color_bo[i])) {
-                dev_warn(p->dev, "%s offset[%d] %d too big\n", __func__, i, track->cb_color_bo_offset[i]);
+
+        if (!IS_ALIGNED(pitch, pitch_align)) {
+                dev_warn(p->dev, "%s:%d cb pitch (%d, 0x%x, %d) invalid\n",
+                         __func__, __LINE__, pitch, pitch_align, array_mode);
                 return -EINVAL;
         }
-        if (!IS_ALIGNED(track->cb_color_bo_offset[i], track->group_size)) {
-                dev_warn(p->dev, "%s offset[%d] %d not aligned\n", __func__, i, track->cb_color_bo_offset[i]);
+        if (!IS_ALIGNED(height, height_align)) {
+                dev_warn(p->dev, "%s:%d cb height (%d, 0x%x, %d) invalid\n",
+                         __func__, __LINE__, height, height_align, array_mode);
                 return -EINVAL;
         }
+        if (!IS_ALIGNED(base_offset, base_align)) {
+                dev_warn(p->dev, "%s offset[%d] 0x%llx 0x%llx, %d not aligned\n", __func__, i,
+                         base_offset, base_align, array_mode);
+                return -EINVAL;
+        }
+
+        /* check offset */
+        tmp = fmt_get_nblocksy(format, height) * fmt_get_nblocksx(format, pitch) * fmt_get_blocksize(format);
+        if ((tmp + track->cb_color_bo_offset[i]) > radeon_bo_size(track->cb_color_bo[i])) {
+                if (array_mode == V_0280A0_ARRAY_LINEAR_GENERAL) {
+                        /* the initial DDX does bad things with the CB size occasionally */
+                        /* it rounds up height too far for slice tile max but the BO is smaller */
+                        /* r600c,g also seem to flush at bad times in some apps resulting in
+                         * bogus values here. So for linear just allow anything to avoid breaking
+                         * broken userspace.
+                         */
+                } else {
+                        dev_warn(p->dev, "%s offset[%d] %d %d %d %lu too big\n", __func__, i,
+                                 array_mode,
+                                 track->cb_color_bo_offset[i], tmp,
+                                 radeon_bo_size(track->cb_color_bo[i]));
+                        return -EINVAL;
+                }
+        }
         /* limit max tile */
-        tmp = (height * pitch * 8) >> 6;
+        tmp = (height * pitch) >> 6;
         if (tmp < slice_tile_max)
                 slice_tile_max = tmp;
-        tmp = S_028060_PITCH_TILE_MAX(pitch - 1) |
+        tmp = S_028060_PITCH_TILE_MAX((pitch / 8) - 1) |
                 S_028060_SLICE_TILE_MAX(slice_tile_max - 1);
         ib[track->cb_color_size_idx[i]] = tmp;
         return 0;
@@ -296,7 +475,12 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
         /* Check depth buffer */
         if (G_028800_STENCIL_ENABLE(track->db_depth_control) ||
                 G_028800_Z_ENABLE(track->db_depth_control)) {
-                u32 nviews, bpe, ntiles, pitch, pitch_align, height, size;
+                u32 nviews, bpe, ntiles, size, slice_tile_max;
+                u32 height, height_align, pitch, pitch_align, depth_align;
+                u64 base_offset, base_align;
+                struct array_mode_checker array_check;
+                int array_mode;
+
                 if (track->db_bo == NULL) {
                         dev_warn(p->dev, "z/stencil with no depth buffer\n");
                         return -EINVAL;
@@ -339,39 +523,34 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
                         ib[track->db_depth_size_idx] = S_028000_SLICE_TILE_MAX(tmp - 1) | (track->db_depth_size & 0x3FF);
                 } else {
                         size = radeon_bo_size(track->db_bo);
-                        pitch = G_028000_PITCH_TILE_MAX(track->db_depth_size) + 1;
-                        height = size / (pitch * 8 * bpe);
-                        height &= ~0x7;
-                        if (!height)
-                                height = 8;
-
-                        switch (G_028010_ARRAY_MODE(track->db_depth_info)) {
+                        /* pitch in pixels */
+                        pitch = (G_028000_PITCH_TILE_MAX(track->db_depth_size) + 1) * 8;
+                        slice_tile_max = G_028000_SLICE_TILE_MAX(track->db_depth_size) + 1;
+                        slice_tile_max *= 64;
+                        height = slice_tile_max / pitch;
+                        if (height > 8192)
+                                height = 8192;
+                        base_offset = track->db_bo_mc + track->db_offset;
+                        array_mode = G_028010_ARRAY_MODE(track->db_depth_info);
+                        array_check.array_mode = array_mode;
+                        array_check.group_size = track->group_size;
+                        array_check.nbanks = track->nbanks;
+                        array_check.npipes = track->npipes;
+                        array_check.nsamples = track->nsamples;
+                        array_check.blocksize = bpe;
+                        if (r600_get_array_mode_alignment(&array_check,
+                                                          &pitch_align, &height_align, &depth_align, &base_align)) {
+                                dev_warn(p->dev, "%s invalid tiling %d (0x%08X)\n", __func__,
+                                         G_028010_ARRAY_MODE(track->db_depth_info),
+                                         track->db_depth_info);
+                                return -EINVAL;
+                        }
+                        switch (array_mode) {
                         case V_028010_ARRAY_1D_TILED_THIN1:
-                                pitch_align = (max((u32)8, (u32)(track->group_size / (8 * bpe))) / 8);
-                                if (!IS_ALIGNED(pitch, pitch_align)) {
-                                        dev_warn(p->dev, "%s:%d db pitch (%d) invalid\n",
-                                                 __func__, __LINE__, pitch);
-                                        return -EINVAL;
-                                }
-                                if (!IS_ALIGNED(height, 8)) {
-                                        dev_warn(p->dev, "%s:%d db height (%d) invalid\n",
-                                                 __func__, __LINE__, height);
-                                        return -EINVAL;
-                                }
+                                /* don't break userspace */
+                                height &= ~0x7;
                                 break;
                         case V_028010_ARRAY_2D_TILED_THIN1:
-                                pitch_align = max((u32)track->nbanks,
-                                                  (u32)(((track->group_size / 8) / bpe) * track->nbanks));
-                                if (!IS_ALIGNED(pitch, pitch_align)) {
-                                        dev_warn(p->dev, "%s:%d db pitch (%d) invalid\n",
-                                                 __func__, __LINE__, pitch);
-                                        return -EINVAL;
-                                }
-                                if ((height / 8) & (track->nbanks - 1)) {
-                                        dev_warn(p->dev, "%s:%d db height (%d) invalid\n",
-                                                 __func__, __LINE__, height);
-                                        return -EINVAL;
-                                }
                                 break;
                         default:
                                 dev_warn(p->dev, "%s invalid tiling %d (0x%08X)\n", __func__,
@@ -379,17 +558,31 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
                                          track->db_depth_info);
                                 return -EINVAL;
                         }
-                        if (!IS_ALIGNED(track->db_offset, track->group_size)) {
-                                dev_warn(p->dev, "%s offset[%d] %d not aligned\n", __func__, i, track->db_offset);
+
+                        if (!IS_ALIGNED(pitch, pitch_align)) {
+                                dev_warn(p->dev, "%s:%d db pitch (%d, 0x%x, %d) invalid\n",
+                                         __func__, __LINE__, pitch, pitch_align, array_mode);
                                 return -EINVAL;
                         }
+                        if (!IS_ALIGNED(height, height_align)) {
+                                dev_warn(p->dev, "%s:%d db height (%d, 0x%x, %d) invalid\n",
+                                         __func__, __LINE__, height, height_align, array_mode);
+                                return -EINVAL;
+                        }
+                        if (!IS_ALIGNED(base_offset, base_align)) {
+                                dev_warn(p->dev, "%s offset[%d] 0x%llx, 0x%llx, %d not aligned\n", __func__, i,
+                                         base_offset, base_align, array_mode);
+                                return -EINVAL;
+                        }
+
                         ntiles = G_028000_SLICE_TILE_MAX(track->db_depth_size) + 1;
                         nviews = G_028004_SLICE_MAX(track->db_depth_view) + 1;
                         tmp = ntiles * bpe * 64 * nviews;
                         if ((tmp + track->db_offset) > radeon_bo_size(track->db_bo)) {
-                                dev_warn(p->dev, "z/stencil buffer too small (0x%08X %d %d %d -> %d have %ld)\n",
-                                                track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
-                                                radeon_bo_size(track->db_bo));
+                                dev_warn(p->dev, "z/stencil buffer (%d) too small (0x%08X %d %d %d -> %u have %lu)\n",
+                                         array_mode,
+                                         track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
+                                         radeon_bo_size(track->db_bo));
                                 return -EINVAL;
                         }
                 }
@@ -595,33 +788,28 @@ static int r600_cs_packet_parse_vline(struct radeon_cs_parser *p)
         if (wait_reg_mem.type != PACKET_TYPE3 ||
             wait_reg_mem.opcode != PACKET3_WAIT_REG_MEM) {
                 DRM_ERROR("vline wait missing WAIT_REG_MEM segment\n");
-                r = -EINVAL;
-                return r;
+                return -EINVAL;
         }
 
         wait_reg_mem_info = radeon_get_ib_value(p, wait_reg_mem.idx + 1);
         /* bit 4 is reg (0) or mem (1) */
         if (wait_reg_mem_info & 0x10) {
                 DRM_ERROR("vline WAIT_REG_MEM waiting on MEM rather than REG\n");
-                r = -EINVAL;
-                return r;
+                return -EINVAL;
         }
         /* waiting for value to be equal */
         if ((wait_reg_mem_info & 0x7) != 0x3) {
                 DRM_ERROR("vline WAIT_REG_MEM function not equal\n");
-                r = -EINVAL;
-                return r;
+                return -EINVAL;
         }
         if ((radeon_get_ib_value(p, wait_reg_mem.idx + 2) << 2) != AVIVO_D1MODE_VLINE_STATUS) {
                 DRM_ERROR("vline WAIT_REG_MEM bad reg\n");
-                r = -EINVAL;
-                return r;
+                return -EINVAL;
         }
 
         if (radeon_get_ib_value(p, wait_reg_mem.idx + 5) != AVIVO_D1MODE_VLINE_STAT) {
                 DRM_ERROR("vline WAIT_REG_MEM bad bit mask\n");
-                r = -EINVAL;
-                return r;
+                return -EINVAL;
         }
 
         /* jump over the NOP */
@@ -640,8 +828,7 @@ static int r600_cs_packet_parse_vline(struct radeon_cs_parser *p)
         obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 DRM_ERROR("cannot find crtc %d\n", crtc_id);
-                r = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
         crtc = obj_to_crtc(obj);
         radeon_crtc = to_radeon_crtc(crtc);
@@ -664,14 +851,13 @@ static int r600_cs_packet_parse_vline(struct radeon_cs_parser *p)
                         break;
                 default:
                         DRM_ERROR("unknown crtc reloc\n");
-                        r = -EINVAL;
-                        goto out;
+                        return -EINVAL;
                 }
                 ib[h_idx] = header;
                 ib[h_idx + 4] = AVIVO_D2MODE_VLINE_STATUS >> 2;
         }
-out:
-        return r;
+
+        return 0;
 }
 
 static int r600_packet0_check(struct radeon_cs_parser *p,
@@ -743,7 +929,7 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
                 return 0;
         ib = p->ib->ptr;
         switch (reg) {
-        /* force following reg to 0 in an attemp to disable out buffer
+        /* force following reg to 0 in an attempt to disable out buffer
          * which will need us to better understand how it works to perform
          * security check on it (Jerome)
          */
@@ -938,6 +1124,7 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_base_last[tmp] = ib[idx];
                 track->cb_color_bo[tmp] = reloc->robj;
+                track->cb_color_bo_mc[tmp] = reloc->lobj.gpu_offset;
                 break;
         case DB_DEPTH_BASE:
                 r = r600_cs_packet_next_reloc(p, &reloc);
@@ -949,6 +1136,7 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
                 track->db_offset = radeon_get_ib_value(p, idx) << 8;
                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                 track->db_bo = reloc->robj;
+                track->db_bo_mc = reloc->lobj.gpu_offset;
                 break;
         case DB_HTILE_DATA_BASE:
         case SQ_PGM_START_FS:
@@ -1019,39 +1207,61 @@ static inline int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx
         return 0;
 }
 
-static inline unsigned minify(unsigned size, unsigned levels)
+static inline unsigned mip_minify(unsigned size, unsigned level)
 {
-        size = size >> levels;
-        if (size < 1)
-                size = 1;
-        return size;
+        unsigned val;
+
+        val = max(1U, size >> level);
+        if (level > 0)
+                val = roundup_pow_of_two(val);
+        return val;
 }
 
-static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned nlevels,
-                              unsigned w0, unsigned h0, unsigned d0, unsigned bpe,
-                              unsigned pitch_align,
+static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+                              unsigned w0, unsigned h0, unsigned d0, unsigned format,
+                              unsigned block_align, unsigned height_align, unsigned base_align,
                               unsigned *l0_size, unsigned *mipmap_size)
 {
-        unsigned offset, i, level, face;
-        unsigned width, height, depth, rowstride, size;
+        unsigned offset, i, level;
+        unsigned width, height, depth, size;
+        unsigned blocksize;
+        unsigned nbx, nby;
+        unsigned nlevels = llevel - blevel + 1;
 
-        w0 = minify(w0, 0);
-        h0 = minify(h0, 0);
-        d0 = minify(d0, 0);
+        *l0_size = -1;
+        blocksize = fmt_get_blocksize(format);
+
+        w0 = mip_minify(w0, 0);
+        h0 = mip_minify(h0, 0);
+        d0 = mip_minify(d0, 0);
         for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
-                width = minify(w0, i);
-                height = minify(h0, i);
-                depth = minify(d0, i);
-                for(face = 0; face < nfaces; face++) {
-                        rowstride = ALIGN((width * bpe), pitch_align);
-                        size = height * rowstride * depth;
-                        offset += size;
-                        offset = (offset + 0x1f) & ~0x1f;
-                }
+                width = mip_minify(w0, i);
+                nbx = fmt_get_nblocksx(format, width);
+
+                nbx = round_up(nbx, block_align);
+
+                height = mip_minify(h0, i);
+                nby = fmt_get_nblocksy(format, height);
+                nby = round_up(nby, height_align);
+
+                depth = mip_minify(d0, i);
+
+                size = nbx * nby * blocksize;
+                if (nfaces)
+                        size *= nfaces;
+                else
+                        size *= depth;
+
+                if (i == 0)
+                        *l0_size = size;
+
+                if (i == 0 || i == 1)
+                        offset = round_up(offset, base_align);
+
+                offset += size;
         }
-        *l0_size = ALIGN((w0 * bpe), pitch_align) * h0 * d0;
         *mipmap_size = offset;
-        if (!nlevels)
+        if (llevel == 0)
                 *mipmap_size = *l0_size;
         if (!blevel)
                 *mipmap_size -= *l0_size;
@@ -1070,16 +1280,27 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned nlevels
 static inline int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
                                               struct radeon_bo *texture,
                                               struct radeon_bo *mipmap,
+                                              u64 base_offset,
+                                              u64 mip_offset,
                                               u32 tiling_flags)
 {
         struct r600_cs_track *track = p->track;
-        u32 nfaces, nlevels, blevel, w0, h0, d0, bpe = 0;
-        u32 word0, word1, l0_size, mipmap_size, pitch, pitch_align;
+        u32 nfaces, llevel, blevel, w0, h0, d0;
+        u32 word0, word1, l0_size, mipmap_size, word2, word3;
+        u32 height_align, pitch, pitch_align, depth_align;
+        u32 array, barray, larray;
+        u64 base_align;
+        struct array_mode_checker array_check;
+        u32 format;
 
         /* on legacy kernel we don't perform advanced check */
         if (p->rdev == NULL)
                 return 0;
 
+        /* convert to bytes */
+        base_offset <<= 8;
+        mip_offset <<= 8;
+
         word0 = radeon_get_ib_value(p, idx + 0);
         if (tiling_flags & RADEON_TILING_MACRO)
                 word0 |= S_038000_TILE_MODE(V_038000_ARRAY_2D_TILED_THIN1);
@@ -1096,82 +1317,89 @@ static inline int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 i
         case V_038000_SQ_TEX_DIM_3D:
                 break;
         case V_038000_SQ_TEX_DIM_CUBEMAP:
-                nfaces = 6;
+                if (p->family >= CHIP_RV770)
+                        nfaces = 8;
+                else
+                        nfaces = 6;
                 break;
         case V_038000_SQ_TEX_DIM_1D_ARRAY:
         case V_038000_SQ_TEX_DIM_2D_ARRAY:
+                array = 1;
+                break;
         case V_038000_SQ_TEX_DIM_2D_MSAA:
         case V_038000_SQ_TEX_DIM_2D_ARRAY_MSAA:
         default:
                 dev_warn(p->dev, "this kernel doesn't support %d texture dim\n", G_038000_DIM(word0));
                 return -EINVAL;
         }
-        if (r600_bpe_from_format(&bpe,  G_038004_DATA_FORMAT(word1))) {
+        format = G_038004_DATA_FORMAT(word1);
+        if (!fmt_is_valid_texture(format, p->family)) {
                 dev_warn(p->dev, "%s:%d texture invalid format %d\n",
-                         __func__, __LINE__, G_038004_DATA_FORMAT(word1));
+                         __func__, __LINE__, format);
                 return -EINVAL;
         }
 
-        pitch = G_038000_PITCH(word0) + 1;
-        switch (G_038000_TILE_MODE(word0)) {
-        case V_038000_ARRAY_LINEAR_GENERAL:
-                pitch_align = 1;
-                /* XXX check height align */
-                break;
-        case V_038000_ARRAY_LINEAR_ALIGNED:
-                pitch_align = max((u32)64, (u32)(track->group_size / bpe)) / 8;
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d tex pitch (%d) invalid\n",
-                                 __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                /* XXX check height align */
-                break;
-        case V_038000_ARRAY_1D_TILED_THIN1:
-                pitch_align = max((u32)8, (u32)(track->group_size / (8 * bpe))) / 8;
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d tex pitch (%d) invalid\n",
-                                 __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                /* XXX check height align */
-                break;
-        case V_038000_ARRAY_2D_TILED_THIN1:
-                pitch_align = max((u32)track->nbanks,
-                                  (u32)(((track->group_size / 8) / bpe) * track->nbanks));
-                if (!IS_ALIGNED(pitch, pitch_align)) {
-                        dev_warn(p->dev, "%s:%d tex pitch (%d) invalid\n",
-                                __func__, __LINE__, pitch);
-                        return -EINVAL;
-                }
-                /* XXX check height align */
-                break;
-        default:
-                dev_warn(p->dev, "%s invalid tiling %d (0x%08X)\n", __func__,
-                         G_038000_TILE_MODE(word0), word0);
+        /* pitch in texels */
+        pitch = (G_038000_PITCH(word0) + 1) * 8;
+        array_check.array_mode = G_038000_TILE_MODE(word0);
+        array_check.group_size = track->group_size;
+        array_check.nbanks = track->nbanks;
+        array_check.npipes = track->npipes;
+        array_check.nsamples = 1;
+        array_check.blocksize = fmt_get_blocksize(format);
+        if (r600_get_array_mode_alignment(&array_check,
+                                          &pitch_align, &height_align, &depth_align, &base_align)) {
+                dev_warn(p->dev, "%s:%d tex array mode (%d) invalid\n",
+                         __func__, __LINE__, G_038000_TILE_MODE(word0));
+                return -EINVAL;
+        }
+
+        /* XXX check height as well... */
+
+        if (!IS_ALIGNED(pitch, pitch_align)) {
+                dev_warn(p->dev, "%s:%d tex pitch (%d, 0x%x, %d) invalid\n",
+                         __func__, __LINE__, pitch, pitch_align, G_038000_TILE_MODE(word0));
+                return -EINVAL;
+        }
+        if (!IS_ALIGNED(base_offset, base_align)) {
+                dev_warn(p->dev, "%s:%d tex base offset (0x%llx, 0x%llx, %d) invalid\n",
+                         __func__, __LINE__, base_offset, base_align, G_038000_TILE_MODE(word0));
+                return -EINVAL;
+        }
+        if (!IS_ALIGNED(mip_offset, base_align)) {
+                dev_warn(p->dev, "%s:%d tex mip offset (0x%llx, 0x%llx, %d) invalid\n",
+                         __func__, __LINE__, mip_offset, base_align, G_038000_TILE_MODE(word0));
                 return -EINVAL;
         }
-        /* XXX check offset align */
+
+        word2 = radeon_get_ib_value(p, idx + 2) << 8;
+        word3 = radeon_get_ib_value(p, idx + 3) << 8;
 
         word0 = radeon_get_ib_value(p, idx + 4);
         word1 = radeon_get_ib_value(p, idx + 5);
         blevel = G_038010_BASE_LEVEL(word0);
-        nlevels = G_038014_LAST_LEVEL(word1);
-        r600_texture_size(nfaces, blevel, nlevels, w0, h0, d0, bpe,
-                          (pitch_align * bpe),
+        llevel = G_038014_LAST_LEVEL(word1);
+        if (array == 1) {
+                barray = G_038014_BASE_ARRAY(word1);
+                larray = G_038014_LAST_ARRAY(word1);
+
+                nfaces = larray - barray + 1;
+        }
+        r600_texture_size(nfaces, blevel, llevel, w0, h0, d0, format,
+                          pitch_align, height_align, base_align,
                           &l0_size, &mipmap_size);
         /* using get ib will give us the offset into the texture bo */
-        word0 = radeon_get_ib_value(p, idx + 2) << 8;
-        if ((l0_size + word0) > radeon_bo_size(texture)) {
+        if ((l0_size + word2) > radeon_bo_size(texture)) {
                 dev_warn(p->dev, "texture bo too small (%d %d %d %d -> %d have %ld)\n",
-                        w0, h0, bpe, word0, l0_size, radeon_bo_size(texture));
+                        w0, h0, format, word2, l0_size, radeon_bo_size(texture));
+                dev_warn(p->dev, "alignments %d %d %d %lld\n", pitch, pitch_align, height_align, base_align);
                 return -EINVAL;
         }
         /* using get ib will give us the offset into the mipmap bo */
-        word0 = radeon_get_ib_value(p, idx + 3) << 8;
-        if ((mipmap_size + word0) > radeon_bo_size(mipmap)) {
+        word3 = radeon_get_ib_value(p, idx + 3) << 8;
+        if ((mipmap_size + word3) > radeon_bo_size(mipmap)) {
                 /*dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
-                  w0, h0, bpe, blevel, nlevels, word0, mipmap_size, radeon_bo_size(texture));*/
+                  w0, h0, format, blevel, nlevels, word3, mipmap_size, radeon_bo_size(texture));*/
         }
         return 0;
 }
@@ -1194,6 +1422,38 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
         idx_value = radeon_get_ib_value(p, idx);
 
         switch (pkt->opcode) {
+        case PACKET3_SET_PREDICATION:
+        {
+                int pred_op;
+                int tmp;
+                if (pkt->count != 1) {
+                        DRM_ERROR("bad SET PREDICATION\n");
+                        return -EINVAL;
+                }
+
+                tmp = radeon_get_ib_value(p, idx + 1);
+                pred_op = (tmp >> 16) & 0x7;
+
+                /* for the clear predicate operation */
+                if (pred_op == 0)
+                        return 0;
+
+                if (pred_op > 2) {
+                        DRM_ERROR("bad SET PREDICATION operation %d\n", pred_op);
+                        return -EINVAL;
+                }
+
+                r = r600_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("bad SET PREDICATION\n");
+                        return -EINVAL;
+                }
+
+                ib[idx + 0] = idx_value + (u32)(reloc->lobj.gpu_offset & 0xffffffff);
+                ib[idx + 1] = tmp + (upper_32_bits(reloc->lobj.gpu_offset) & 0xff);
+        }
+        break;
+
         case PACKET3_START_3D_CMDBUF:
                 if (p->family >= CHIP_RV770 || pkt->count) {
                         DRM_ERROR("bad START_3D\n");
@@ -1386,7 +1646,10 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                 mip_offset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 mipmap = reloc->robj;
                                 r = r600_check_texture_resource(p,  idx+(i*7)+1,
-                                                                texture, mipmap, reloc->lobj.tiling_flags);
+                                                                texture, mipmap,
+                                                                base_offset + radeon_get_ib_value(p, idx+1+(i*7)+2),
+                                                                mip_offset + radeon_get_ib_value(p, idx+1+(i*7)+3),
+                                                                reloc->lobj.tiling_flags);
                                 if (r)
                                         return r;
                                 ib[idx+1+(i*7)+2] += base_offset;