1 files changed, 53 insertions, 20 deletions

diff --git a/drivers/gpu/drm/nouveau/core/engine/dmaobj/base.c b/drivers/gpu/drm/nouveau/core/engine/dmaobj/base.c
index 2472c6b7489f..e1500f77a56a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/dmaobj/base.c
+++ b/drivers/gpu/drm/nouveau/core/engine/dmaobj/base.c
@@ -23,9 +23,12 @@
  */
 
 #include <core/object.h>
-#include <core/class.h>
+#include <core/client.h>
+#include <nvif/unpack.h>
+#include <nvif/class.h>
 
 #include <subdev/fb.h>
+#include <subdev/instmem.h>
 
 #include "priv.h"
 
@@ -57,57 +60,87 @@ nvkm_dmaobj_create_(struct nouveau_object *parent,
 		    struct nouveau_oclass *oclass, void **pdata, u32 *psize,
 		    int length, void **pobject)
 {
-	struct nv_dma_class *args = *pdata;
+	union {
+		struct nv_dma_v0 v0;
+	} *args = *pdata;
+	struct nouveau_instmem *instmem = nouveau_instmem(parent);
+	struct nouveau_client *client = nouveau_client(parent);
+	struct nouveau_device *device = nv_device(parent);
+	struct nouveau_fb *pfb = nouveau_fb(parent);
 	struct nouveau_dmaobj *dmaobj;
+	void *data = *pdata;
+	u32 size = *psize;
 	int ret;
 
-	if (*psize < sizeof(*args))
-		return -EINVAL;
-	*pdata = &args->conf0;
-
 	ret = nouveau_object_create_(parent, engine, oclass, 0, length, pobject);
 	dmaobj = *pobject;
 	if (ret)
 		return ret;
 
-	switch (args->flags & NV_DMA_TARGET_MASK) {
-	case NV_DMA_TARGET_VM:
+	nv_ioctl(parent, "create dma size %d\n", *psize);
+	if (nvif_unpack(args->v0, 0, 0, true)) {
+		nv_ioctl(parent, "create dma vers %d target %d access %d "
+				 "start %016llx limit %016llx\n",
+			 args->v0.version, args->v0.target, args->v0.access,
+			 args->v0.start, args->v0.limit);
+		dmaobj->target = args->v0.target;
+		dmaobj->access = args->v0.access;
+		dmaobj->start  = args->v0.start;
+		dmaobj->limit  = args->v0.limit;
+	} else
+		return ret;
+
+	*pdata = data;
+	*psize = size;
+
+	if (dmaobj->start > dmaobj->limit)
+		return -EINVAL;
+
+	switch (dmaobj->target) {
+	case NV_DMA_V0_TARGET_VM:
 		dmaobj->target = NV_MEM_TARGET_VM;
 		break;
-	case NV_DMA_TARGET_VRAM:
+	case NV_DMA_V0_TARGET_VRAM:
+		if (!client->super) {
+			if (dmaobj->limit >= pfb->ram->size - instmem->reserved)
+				return -EACCES;
+			if (device->card_type >= NV_50)
+				return -EACCES;
+		}
 		dmaobj->target = NV_MEM_TARGET_VRAM;
 		break;
-	case NV_DMA_TARGET_PCI:
+	case NV_DMA_V0_TARGET_PCI:
+		if (!client->super)
+			return -EACCES;
 		dmaobj->target = NV_MEM_TARGET_PCI;
 		break;
-	case NV_DMA_TARGET_PCI_US:
-	case NV_DMA_TARGET_AGP:
+	case NV_DMA_V0_TARGET_PCI_US:
+	case NV_DMA_V0_TARGET_AGP:
+		if (!client->super)
+			return -EACCES;
 		dmaobj->target = NV_MEM_TARGET_PCI_NOSNOOP;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	switch (args->flags & NV_DMA_ACCESS_MASK) {
-	case NV_DMA_ACCESS_VM:
+	switch (dmaobj->access) {
+	case NV_DMA_V0_ACCESS_VM:
 		dmaobj->access = NV_MEM_ACCESS_VM;
 		break;
-	case NV_DMA_ACCESS_RD:
+	case NV_DMA_V0_ACCESS_RD:
 		dmaobj->access = NV_MEM_ACCESS_RO;
 		break;
-	case NV_DMA_ACCESS_WR:
+	case NV_DMA_V0_ACCESS_WR:
 		dmaobj->access = NV_MEM_ACCESS_WO;
 		break;
-	case NV_DMA_ACCESS_RDWR:
+	case NV_DMA_V0_ACCESS_RDWR:
 		dmaobj->access = NV_MEM_ACCESS_RW;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	dmaobj->start = args->start;
-	dmaobj->limit = args->limit;
-	dmaobj->conf0 = args->conf0;
 	return ret;
 }