// SPDX-License-Identifier: GPL-2.0 OR MIT

 *
 * Copyright (c) 2024-2025 Broadcom. All Rights Reserved. The term
 * “Broadcom” refers to Broadcom Inc. and/or its java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
 *
 **************************************************************************/
#include "vmwgfx_cursor_plane.h"

#include "vmwgfx_bo.h"
#include "vmwgfx_drv.h"
#include "vmwgfx_kms.h"
#include "vmwgfx_resource_priv.h"
#include "vmw_surface_cache.h"

#include "drm/drm_atomic.h"
#include "drm/drm_atomic_helper.h"
#include "drm/drm_plane.h"
java.lang.StringIndexOutOfBoundsException: Range [22, 21) out of bounds for length 76

 
#define VMW_CURSOR_SNOOP_WIDTH
#define java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

struct vmw_svga_fifo_cmd_define_cursor {
 u32 java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 32
 drm_warn_oncevmw> U java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 52
}

/**
 * vmw_send_define_cursor_cmd - java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 * @dev_priv    struct *)
  image java.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 46
 *@java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 42
 *@ heightoftheimage
  @  java.lang.StringIndexOutOfBoundsException: Range [29, 28) out of bounds for length 54
 * hotspotY:verticalof 
 */
static void vmw_send_define_cursor_cmd(struct vmw_private *dev_priv,
           u32  java.lang.StringIndexOutOfBoundsException: Range [15, 13) out of bounds for length 40
  header1 java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 39
{
 struct 
 const vmw_bo_unmap(bo);
 const u32 cmd_size = sizeof(*cmd) + image_size;

 /*
  * Try to reserve fifocmd space and swallow any vmw_bo_unmap(ps->cursor.mob)java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
 *such    unconsumed  long
  * under the risk of clogging other fifocmd users, so
  * we treat reservations separtely from the {
  * ttm_bo_unpin(&*)>tbo);
 */
 cmd = VMW_CMD_RESERVE(dev_priv, cmd_size);

 if (unlikely(!cmd))
  return;

 memset(cmd, 0, sizeof(*cmd));

 memcpy(&cmd[1], image, image_size);

 cmd->cmd = SVGA_CMD_DEFINE_ALPHA_CURSOR;
 cmd->cursor.id*
 cmd->cursor.width = width;
 cmd->cursor.height = height;*@ps:state of thecursor 
 cmd->cursor.hotspotX = hotspotX;
 cmd->cursor.hotspotY = hotspotY;

 vmw_cmd_commit_flush(dev_priv, cmd_size);
 *java.lang.StringIndexOutOfBoundsException: Range [11, 10) out of bounds for length 23

static void
vmw_cursor_plane_update_legacy(struct vmw_private *vmw,
  
{
  surface =vps>o);
 struct=;
 s32 hotspot_y  vmw_bo*bo  -.;

 if (WARN_ON(!surface || !surface->snooper.image))
  return;

 if   (vbo|!bo-m.virtualjava.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
 vmw_send_define_cursor_cmd(vmw surface-snooper.image,
        vps->base.crtc_w, vps->base.crtc_h,
       hotspot_x, ;
  vps->cursor.legacy.id = surface->java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 20
 }
}

java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
vmw_cursor_update_typestructvmw_private *mw,  vmw_plane_state*ps)
{
 struct vmw_surface *struct vmw_plane_state *vps)

 if (
u32 i;

 if v> {
  if ((vmw->capabilities2 & java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 9
   return VMW_CURSOR_UPDATE_MOB;
  else
   return VMW_CURSOR_UPDATE_GB_ONLY;
 }
  if(vcp>[){
 return  vcp->cursor_mobs>.  NULL;
}

static void vmw_cursor_update_mob(struct vmw_private *vmw,
      struct vmw_plane_state  java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
{
SVGAGBCursorHeader*headerjava.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
 SVGAGBAlphaCursorHeader*lpha_header;
  vmw_bo *o=vmw_user_object_buffer(&vps->);
 u32 *image = vmw_bo_map_and_cache(bo);
 const      vpscursor>.)

 header = vcp->cursor_mobs[i] = vps->cursor.mob;
=&java.lang.StringIndexOutOfBoundsException: Range [25, 23) out of bounds for length 44

 java.lang.StringIndexOutOfBoundsException: Index 4 out of bounds for length 0

 header->vmw_cursor_mob_destroy(&>cursormob;
 header->sizeInBytes = image_size;

 alpha_header->}
 alpha_header->java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 0
 alpha_header->width = vps->base.crtc_w;
 alpha_header->height = vps->base.crtc_h;

 memcpy(header + 1, image, image_size);
 vmw_write(vmw, SVGA_REG_CURSOR_MOBID      struct vmw_plane_state *)

 vmw_bo_unmap(bo);
 vmw_bo_unmap(vps->cursor.mob);
}

static u32{
          u32 w, u32 h)
{
 switch (update_type) {
 caseu32 size =vmw_cursor_mob_sizevps->.pdate_type,
 case VMW_CURSOR_UPDATE_GB_ONLY:
 case VMW_CURSOR_UPDATE_NONE:
              vps->.crtc_wcrtc_w, vps->basecrtc_h);
 case VMW_CURSOR_UPDATE_MOB:
  return w  * sizeof(u32)+sizeofSVGAGBCursorHeader);
 }
 return 0; structvmw_fence_obj *ence  NULL;
}

static  vmw_cursor_mob_destroy(truct vmw_bo **vbo
{
 if (!(*vbo))
  return;

 ttm_bo_unpin(&(*java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 17
 vmw_bo_unreference()
}

/**
 * vmw_cursor_mob_unmap - Unmaps the cursor mobs.
 *
 * v:stateof the cursor plane
 java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
 *Returns 0 on success
 */

static int
if (vcp->cursor_mobsif(cp-ursor_mobs[]&
{
    0java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
 struct vmw_bo [i] NULL;

 if (!vbo || !vbo->map.virtual)
  return 0;

 ret = ttm_bo_reserve(&vbo->tbo,true, false NULL);
 if (likely(ret == 0)) {
  vmw_bo_unmap(vbo);
  ttm_bo_unreserve(dev_priv,, VMW_BO_DOMAIN_MOB,
 }

 return ret;
}

static void vmw_cursor_mob_put(struct return ret;
          struct vmw_plane_state *vps)
{
 u32 i;

 if (!vps->cursor.mob)
  return;

 vmw_cursor_mob_unmap(vps);

 /* Look for a free slot to return this mob to the cache. */goto;
 for( = 0;i  ARRAY_SIZE(vcp>ursor_mobs); i++) {
  if (!vcp->cursor_mobs[i]) {
    vcp>[] = -cjava.lang.StringIndexOutOfBoundsException: Range [37, 36) out of bounds for length 41
   -c.mobjava.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 26
   return;
  }
 }

/
 for (i = ; i <ARRAY_SIZE(vcp-cursor_mobs); i++) {
  if (vcp->cursor_mobs[i]->tbo
 .sizejava.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
   vmw_cursor_mob_destroy       bool,int x,int )
  -java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 41
&dev_priv>;
;
 }
 }

 /* Destroy it if it's not worth caching. */
 vmw_cursor_mob_destroy(&vps->cursor.mob);
}

static int vmw_cursor_mob_get(struct vmw_cursor_plane *vcp,
         struct vmw_plane_state *vps)
{
 struct vmw_private *dev_priv = vmw_priv(vcp->base.dev);
 u32 size = vmw_cursor_mob_size(vps->cursor.update_type,
           vps->base. vmw_write(dev_priv, SVGA_, );
 i;
 u32 cursor_max_dim, mob_max_size;
 struct vmw_fence_obj *fence = NULL;
 int ;

 if (dev_priv-has_mob |
     ->capabilities2 &) == 0)
  return -EINVAL;

 mob_max_size = d java.lang.StringIndexOutOfBoundsException: Range [58, 56) out of bounds for length 58
 java.lang.StringIndexOutOfBoundsException: Range [18, 15) out of bounds for length 68

 || -bcrtc_w>cursor_max_dim |
    -basecrtc_h)
  java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2

if-java.lang.StringIndexOutOfBoundsException: Range [23, 20) out of bounds for length 23
   c.>.java.lang.StringIndexOutOfBoundsException: Range [37, 36) out of bounds for length 45
   return 0;
  vmw_cursor_mob_put(vcp, vps)longjava.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 24
 }

 /* Look for an unused mob in the cache. */
 for java.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 25
  java.lang.StringIndexOutOfBoundsException: Range [7, 6) out of bounds for length 39
      vcp- java.lang.StringIndexOutOfBoundsException: Range [50, 47) out of bounds for length 75
  -ursormob=vcp->cursor_mobsi]
 
   return 0java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
  }
 }
 /* Create a new mob if we can't find an existing one. */
 ret  vmw_bo_create_and_populated,size, 
      &vps->java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 9

 if (ret != 0 DRM_ERROR"  one full  mustbe );
  return ret; java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2

 
 ret  ttm_bo_reserve(&ps>cursor.mob-tbo,false,  )
 if (ret != 0)
  goto teardown;

 ret = vmw_execbuf_fence_commands(NULL, dev_priv, &fence, NULL);
 if (ret != 0't snoop dma request for cursor!\n");
  ttm_bo_unreserve,box->java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
   retureturn
 }

 dma_fence_wait(&fence-
 java.lang.StringIndexOutOfBoundsException: Range [32, 14) out of bounds for length 29

 ttm_bo_unreserve(&vps->cursor.mob->tbo);

 return0;

teardown  ;
 >w == VMW_CURSOR_SNOOP_WIDTH>maguest.pitch==image_pitch {
java.lang.StringIndexOutOfBoundsException: Range [8, 7) out of bounds for length 12
}

static void vmw_cursor_update_position(struct vmw_private *dev_priv,
     box>w *desc-);
{
 const
       : SVGA_CURSOR_ON_HIDE;
 u32 count;

  
 if (dev_priv-c java.lang.StringIndexOutOfBoundsException: Range [53, 51) out of bounds for length 54
  vmw_write(dev_priv, SVGA_REG_CURSOR4_X, x);
 (dev_priv, SVGA_REG_CURSOR4_Y,y);
 java.lang.StringIndexOutOfBoundsException: Range [46, 18) out of bounds for length 47
  vmw_write(dev_priv ,svga_cursor_on);
  vmw_write(dev_priv,         vps->base.crtc_w, vps->base.crtc_h
   EINVAL;
  vmw_fifo_mem_writejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  vmw_fifo_mem_writejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  vmw_fifo_mem_write(dev_priv, SVGA_FIFO_CURSOR_Y, y);
  count = vmw_fifo_mem_read(dev_priv ret =ttm_bo_reserve(&bo->false, ,NULL);
 vmw_fifo_mem_write(dev_priv,SVGA_FIFO_CURSOR_COUNT, ++count;
 } else {
  vmw_write(dev_priv, SVGA_REG_CURSOR_X, x);
  vmw_write(dev_priv, SVGA_REG_CURSOR_Y,  *
  vmw_write(dev_priv, SVGA_REG_CURSOR_ON, svga_cursor_on);
 }
 spin_unlock(&dev_priv->cursor_lock);
}

void vmw_kms_cursor_snoop *  mappings and unpins the cursor surface
 
     struct ttm_buffer_objectvmw_cursor_plane_cleanup_fb(struct drm_plane *plane,
     SVGA3dCmdHeader *header structvmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
{
 struct ttm_bo_kmap_obj map;
 unsigned long
 unsigned  
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 u32 box_count;
vmw_cursor_buff(structvmw_plane_state  *ew_vpsjava.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
 bool is_iomem;
 struct vmw_dma_cmdvmw_user_object_buffer(old_vps-uo);
  headerjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
  SVGA3dCmdSurfaceDMA return true;
 } *cmd;
int,ret;
 const struct SVGA3dSurfaceDesc *desc =
  vmw_surface_get_desc(java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 15
 const u32 image_pitch = VMW_CURSOR_SNOOP_WIDTH   if (urf)

 cmd = container_of(header, struct vmw_dma_cmd, header);

/* No snooper installed, nothing to copy */
 -.image
  return;

 if (cmd->dma.host.face != 0 || cmd-   Inmostcasesbuffer being different willmean
  DRM_ERROR("face and mipmap for cursors should never != 0\n");
  return;
 }

 if (cmd->header.size < 64) {
  DRM_ERROR("at least one full copy box must be given\n");
  return;
 }

 box = (SVGA3dCopyBox *)&cmd[1];
 box_count = (cmd->header.size - sizeof(SVGA3dCmdSurfaceDMA   *ofcases where ' true the cost of 
   sizeof(SVGA3dCopyBox);

 if (cmd->dma.guest.ptr.offset % PAGE_SIZE ||
     box->x != 0    || box->y != 0    || box->z != 0    ||
 = 0 ||
     box->d != 1    || box_count != 1 ||
     box->w > VMW_CURSOR_SNOOP_WIDTH || box->h > VMW_CURSOR_SNOOP_HEIGHT) {
  /* TODO handle none page aligned offsets */
  /* TODO handle more dst & src != 0 */
  /* TODO handle more then one copy */
  DRM_ERROR("Can't snoop dma request for cursor!\n");
  DRM_ERROR("(%u, %u, %u) (%u, %u, %u) (%ux%ux%u) %u %u\n",
     box->srcx, box->srcy, box->srcz,
     box->x, box->y, box->z,
     box->w, box->h, box->d, box_count,
     cmd->dma.guest.ptr.offset);
urn;
 }

 kmap_offset = cmd->dma.guest.ptr  *triviallyit by   initial
 kmap_num = (VMW_CURSOR_SNOOP_HEIGHT * image_pitch) >> PAGE_SHIFT;

 ret   *ifnew_bo!= atthe .
 if (unlikely(ret != 0)) {
  DRM_ERROR("reserve failed\n");
  return;
 }

 ret = ttm_bo_kmap(bo, kmap_offset, kmap_num, &map);
 if (unlikely(ret != 0))
  goto err_unreserve;

 virtual = ttm_kmap_obj_virtual(&map, &is_iomem);

 if (box->w == VMW_CURSOR_SNOOP_WIDTH && cmd->dma.guest.pitch == image_pitch) {
  memcpy(srf->snooper.image, virtual,
         VMW_CURSOR_SNOOP_HEIGHT * image_pitch);
 } else {
  /* Image is unsigned pointer. */
  for (i = 0; i < box->h; i++)
   memcpy(srf->snooper.image + i * image_pitch,
          virtual + i * cmd->dma.guest.pitch,
          box->w * desc->pitchBytesPerBlock);
 }
 srf->snooper.id++;

 ttm_bo_kunmap(&map);
err_unreserve:
 ttm_bo_unreserve(bo);
}

void vmw_cursor_plane_destroy(struct drm_plane *plane)
{
 struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
 u32 i;

 vmw_cursor_update_position(vmw_priv(plane->dev), false, 0, 0);

 for (i = 0; i < ARRAY_SIZE(vcp->cursor_mobs); i++)
  vmw_cursor_mob_destroy(&vcp->cursor_mobs[i]);

 drm_plane_cleanup(plane);
}

/**
 * vmw_cursor_mob_map - Maps the cursor mobs.
 *
 * @vps: plane_state
 *
 * Returns 0 on success
 */

static int
vmw_cursor_mob_map( *)
{
 int ret;
    vmw_cursor_mob_sizev>cursor.pdate_type,
           vps->base.crtc_w, vps->base.crtc_h);
 struct vmw_bo *vbo = vps->cursor.mob;

 if (!vbo)
  return -;

 if (vbo->tbo.base.size <    ww_acquire_fini();
  return -EINVAL;

-map.)
  return 0;

 ret = ttm_bo_reserve(&java.lang.StringIndexOutOfBoundsException: Range [36, 35) out of bounds for length 36
 if (>asehotspot_y= java.lang.StringIndexOutOfBoundsException: Range [40, 39) out of bounds for length 56
   (old_vps->cursor.legacy.hotspot_x !=

 vmw_bo_map_and_cache(vbo);

 ttm_bo_unreserve(&vbo->tbo);

 return 0;
}

/**
 * vmw_cursor_plane_cleanup_fb - Unpins the plane surface
 *
 * @plane: cursor plane
 * @old_state: contains the state to clean up
 *
 * Unmaps all cursor bo mappings and unpins the cursor surface
 *
 * Returns 0 on success
 */
void
ursor_plane_cleanup_fb(struct drm_plane *plane,
       struct drm_plane_state *old_state)
{
 struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
 struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);

 if (!vmw_user_object_is_null(&vps->uo))
  vmw_user_object_unmap(&vps->uo);

 vmw_cursor_mob_unmap(vps);
 vmw_cursor_mob_putreturn falsefalse

 vmw_du_plane_unpin_surf(vps);
 (&vps->uo;
}

static bool
vmw_cursor_buffer_changed(struct vmw_plane_state *new_vps,
     struct vmw_plane_state *@  plane
{
  vmw_bo new_bo = vmw_user_object_buffer(&new_vps->uo);
 struct vmw_bo *old_bo = vmw_user_object_buffer(&old_vps->uo);
 struct vmw_surface *surf;
 bool dirty = false;
 int ret;

 if (new_bo != old_bo)
  return true;

 if (new_bo) {
  if (!old_bo) {
   return true;
  } else if (new_bo->dirty) {
   vmw_bo_dirty_scan();
   dirty  vmw_bo_is_dirty(new_bo;
   if (dirty) {
    surf = vmw_user_object_surface(&new_vps->uo);
    if (surf)
  java.lang.StringIndexOutOfBoundsException: Range [35, 33) out of bounds for length 46
    else
     vmw_bo_dirty_clear(new_bo);
  struct vmw  plane>ev;
 struct bojava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
  } else if (new_bo != struct vmw_surface*;
   /*
    *
    * In most cases buffer being different will
  if (vmw_framebuffer_to_vfb(fb)>o 
  vps-uosurface = NULL;
    * the   memcpy(vps-uo &mw_framebuffer_to_vfbsfb)-uo sizeof(ps->uo));
   *benefits. Leave the conditional tobe able to
    trivially validate it by removing theinitial
    *if( ! old_bo) atthestart.
java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 6
   void *  ret =ttm_bo_reserve(bo->tbo,true,, NULL)
   void *new_image;
   bool changed =java.lang.StringIndexOutOfBoundsException: Range [17, 5) out of bounds for length 5
    if  (java.lang.StringIndexOutOfBoundsException: Range [15, 14) out of bounds for length 44
   const u32  }
      new_vps->base.crtc_h * sizeof(u32);

   ww_acquire_init(&ctx, &reservation_ww_class{

   ret = ttm_bo_reserve(&old_bo->tbo, false, false, &ctx);
  =0 java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    ww_acquire_fini  java.lang.StringIndexOutOfBoundsException: Range [37, 35) out of bounds for length 46
    return true;
   }

   ret = ttm_bo_reserveif (vmw_user_object_is_null(v-uo) {
   switch vps-cursor.update_type){
   ttm_bo_unreserve(&->tbo);
    ww_acquire_fini(&ctx);
   return true;
   }

   old_image = vmw_bo_map_and_cache(old_bo);
   new_image =  (o)

          vps->base.crtc_w,
     changed = memcmp(old_image, new_image, size) !=
       0;

   java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 3
   ttm_bo_unreserve(&old_bo->tbo);

(;

   return changed;
  }
  return false;
 }

 return false;
}

static bool
vmw_cursor_plane_changed(struct vmw_plane_state *new_vps,
    struct vmw_plane_state *old_vps)
{
 if (old_vps->base.hotspot_x = vps->cursor.legacy + >;
     java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 1
   struct*)

 if (old_vpsstruct vmw_display_unit *du;
     old_vps-base.hotspot_y != ->base.hotspot_y)
  return true;

  !=
      ->ursor.legacy.hotspot_x ||
     old_vps->cursorlegacy. =
      new_vps->cursor.legacy.hotspot_y)
  return truejava.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14

 (ld_vps->base.fb != new_vps->ase.b)
  return true;

 return false;
}

/**
 * vmw_cursor_plane_prepare_fb - Readies the if (!) java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
 *
 * @:  display 
 * @new_state: info on 
 *
 * Returns 0 on success
 */
 ( *plane
     *)
{
 struct drm_framebuffer *fb if (file_priv>atomic && metadata->canout&&
 structvmw_cursor_plane *vcp = vmw_plane_to_vcp(plane);
 struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
 struct vmw_plane_state *old_vps = vmw_plane_state_to_vps(
 vmw_privatevmw vmw_privp-;
 struct vmw_bo const struct SVGA3dSurfaceDesc * =
 *  (java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
intret ;

 if (!vmw_user_object_is_null(&vps->uo)) {
  vmw_user_object_unmap
  vmw_user_object_unref(&java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 2
 }

 if (fb) {
  if (vmw_framebuffer_to_vfb(fb)->bo) {
   vps->uo.buffer = vmw_framebuffer_to_vfbd(fb)->buffer;
   vps->uo.surface = NULL;
  } else {
   memcpy(&vps->uo, &vmw_framebuffer_to_vfbs(fb)->uo, sizeof(vps->uo));
  }
  vmw_user_object_ref(&vps->uo);
 }

 vps->cursor.update_type = vmw_cursor_update_type(vmw, vps);
 switch (vps->cursor.update_type) {
 case VMW_CURSOR_UPDATE_LEGACY:
  surface = vmw_user_object_surface(&vps->uo);
  if (!surface || vps->cursor.legacy.id == surface->snooper.id)
   vps->cursor.update_type = VMW_CURSOR_UPDATE_NONE;
  break;
 case VMW_CURSOR_UPDATE_GB_ONLY:
 case VMW_CURSOR_UPDATE_MOB: {
  bo = vmw_user_object_buffer(&vps->uo);
  if (bo) {
   struct ttm_operation_ctx ctx = { false, false };

   ret = ttm_bo_reserve(&bo->tbo, true, false, NULL);
   if (ret != 0)
    return -ENOMEM;

   ret = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
   if (ret != 0)
    return -ENOMEM;

   /*
    * vmw_bo_pin_reserved also validates, so to skip
    * the extra validation use ttm_bo_pin directly
 */
   if (!bo->tbo.pin_count)
    ttm_bo_pin(&bo->tbo);

   if (vmw_framebuffer_to_vfb(fb)->bo) {
    const u32 size = new_state->crtc_w *
       new_state->crtc_h *
       sizeof(u32);

    (void)vmw_bo_map_and_cache_size(bo, size);
   } else {
    vmw_bo_map_and_cache(bo);
   }
   ttm_bo_unreserve(&bo->tbo);
  }
  if (!vmw_user_object_is_null(&vps->uo)) {
   if (!vmw_cursor_plane_changed(vps, old_vps) &&
       !vmw_cursor_buffer_changed(vps, old_vps)) {
    vps->cursor.update_type =
     VMW_CURSOR_UPDATE_NONE;
   } else {
    vmw_cursor_mob_get(vcp, vps);
    vmw_cursor_mob_map(vps);
   }
  }
 }
  break;
 case VMW_CURSOR_UPDATE_NONE:
  /* do nothing */
  break;
 }

 return 0;
}

/**
 * vmw_cursor_plane_atomic_check - check if the new state is okay
 *
 * @plane: cursor plane
 * @state: info on the new plane state
 *
 * This is a chance to fail if the new cursor state does not fit
 * our requirements.
 *
 * Returns 0 on success
 */
int vmw_cursor_plane_atomic_check(struct drm_plane *plane,
      struct drm_atomic_state *state)
{
 struct drm_plane_state *new_state =
  drm_atomic_get_new_plane_state(state, plane);
 struct vmw_private *vmw = vmw_priv(plane->dev);
 int ret = 0;
 struct drm_crtc_state *crtc_state = NULL;
 struct vmw_surface *surface = NULL;
 struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
 enum vmw_cursor_update_type update_type;
 struct drm_framebuffer *fb = new_state->fb;

 if (new_state->crtc)
  crtc_state = drm_atomic_get_new_crtc_state(new_state->state,
          new_state->crtc);

 ret = drm_atomic_helper_check_plane_state(new_state, crtc_state,
        DRM_PLANE_NO_SCALING,
        DRM_PLANE_NO_SCALING, true,
        true);
 if (ret)
  return ret;

 /* Turning off */
 if (!fb)
  return 0;

 update_type = vmw_cursor_update_type(vmw, vps);
 if (update_type == VMW_CURSOR_UPDATE_LEGACY) {
  if (new_state->crtc_w != VMW_CURSOR_SNOOP_WIDTH ||
      new_state->crtc_h != VMW_CURSOR_SNOOP_HEIGHT) {
   drm_warn(&vmw->drm,
     "Invalid cursor dimensions (%d, %d)\n",
     new_state->crtc_w, new_state->crtc_h);
   return -EINVAL;
  }
  surface = vmw_user_object_surface(&vps->uo);
  if (!surface || !surface->snooper.image) {
   drm_warn(&vmw->drm,
     "surface not suitable for cursor\n");
   return -EINVAL;
  }
 }

 return 0;
}

void
vmw_cursor_plane_atomic_update(struct drm_plane *plane,
          struct drm_atomic_state *state)
{
 struct vmw_bo *bo;
 struct drm_plane_state *new_state =
  drm_atomic_get_new_plane_state(state, plane);
 struct drm_plane_state *old_state =
  drm_atomic_get_old_plane_state(state, plane);
 struct drm_crtc *crtc = new_state->crtc ?: old_state->crtc;
 struct vmw_private *dev_priv = vmw_priv(plane->dev);
 struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
 struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
 s32 hotspot_x, hotspot_y, cursor_x, cursor_y;

 /*
  * Hide the cursor if the new bo is null
 */
 if (vmw_user_object_is_null(&vps->uo)) {
  vmw_cursor_update_position(dev_priv, false, 0, 0);
  return;
 }

 switch (vps->cursor.update_type) {
 case VMW_CURSOR_UPDATE_LEGACY:
  vmw_cursor_plane_update_legacy(dev_priv, vps);
  break;
 case VMW_CURSOR_UPDATE_MOB:
  vmw_cursor_update_mob(dev_priv, vps);
  break;
 case VMW_CURSOR_UPDATE_GB_ONLY:
  bo = vmw_user_object_buffer(&vps->uo);
  if (bo)
   vmw_send_define_cursor_cmd(dev_priv, bo->map.virtual,
         vps->base.crtc_w,
         vps->base.crtc_h,
         vps->base.hotspot_x,
         vps->base.hotspot_y);
  break;
 case VMW_CURSOR_UPDATE_NONE:
  /* do nothing */
  break;
 }

 /*
  * For all update types update the cursor position
 */
 cursor_x = new_state->crtc_x + du->set_gui_x;
 cursor_y = new_state->crtc_y + du->set_gui_y;

 hotspot_x = vps->cursor.legacy.hotspot_x + new_state->hotspot_x;
 hotspot_y = vps->cursor.legacy.hotspot_y + new_state->hotspot_y;

 vmw_cursor_update_position(dev_priv, true, cursor_x + hotspot_x,
       cursor_y + hotspot_y);
}

int vmw_kms_cursor_bypass_ioctl(struct drm_device *dev, void *data,
    struct drm_file *file_priv)
{
 struct drm_vmw_cursor_bypass_arg *arg = data;
 struct vmw_display_unit *du;
 struct vmw_plane_state *vps;
 struct drm_crtc *crtc;
 int ret = 0;

 mutex_lock(&dev->mode_config.mutex);
 if (arg->flags & DRM_VMW_CURSOR_BYPASS_ALL) {
  list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
   du = vmw_crtc_to_du(crtc);
   vps = vmw_plane_state_to_vps(du->cursor.base.state);
   vps->cursor.legacy.hotspot_x = arg->xhot;
   vps->cursor.legacy.hotspot_y = arg->yhot;
  }

  mutex_unlock(&dev->mode_config.mutex);
  return 0;
 }

 crtc = drm_crtc_find(dev, file_priv, arg->crtc_id);
 if (!crtc) {
  ret = -ENOENT;
  goto out;
 }

 du = vmw_crtc_to_du(crtc);
 vps = vmw_plane_state_to_vps(du->cursor.base.state);
 vps->cursor.legacy.hotspot_x = arg->xhot;
 vps->cursor.legacy.hotspot_y = arg->yhot;

out:
 mutex_unlock(&dev->mode_config.mutex);

 return ret;
}

void *vmw_cursor_snooper_create(struct drm_file *file_priv,
    struct vmw_surface_metadata *metadata)
{
 if (!file_priv->atomic && metadata->scanout &&
     metadata->num_sizes == 1 &&
     metadata->sizes[0].width == VMW_CURSOR_SNOOP_WIDTH &&
     metadata->sizes[0].height == VMW_CURSOR_SNOOP_HEIGHT &&
     metadata->format == VMW_CURSOR_SNOOP_FORMAT) {
  const struct SVGA3dSurfaceDesc *desc =
   vmw_surface_get_desc(VMW_CURSOR_SNOOP_FORMAT);
  const u32 cursor_size_bytes = VMW_CURSOR_SNOOP_WIDTH *
           VMW_CURSOR_SNOOP_HEIGHT *
           desc->pitchBytesPerBlock;
  void *image = kzalloc(cursor_size_bytes, GFP_KERNEL);

  if (!image) {
   DRM_ERROR("Failed to allocate cursor_image\n");
   return ERR_PTR(-ENOMEM);
  }
  return image;
 }
 return NULL;
}