tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/*
2 * Copyright 2004 The Unichrome Project. All Rights Reserved.
3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sub license,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial portions
14 * of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 * DEALINGS IN THE SOFTWARE.
23 *
24 * Author: Thomas Hellstrom 2004, 2005.
25 * This code was written using docs obtained under NDA from VIA Inc.
26 *
27 * Don't run this code directly on an AGP buffer. Due to cache problems it will
28 * be very slow.
29 */
30
31#include "via_3d_reg.h"
32#include "drmP.h"
33#include "drm.h"
34#include "via_drm.h"
35#include "via_verifier.h"
36#include "via_drv.h"
37
38typedef enum {
39 state_command,
40 state_header2,
41 state_header1,
42 state_vheader5,
43 state_vheader6,
44 state_error
45} verifier_state_t;
46
47typedef enum {
48 no_check = 0,
49 check_for_header2,
50 check_for_header1,
51 check_for_header2_err,
52 check_for_header1_err,
53 check_for_fire,
54 check_z_buffer_addr0,
55 check_z_buffer_addr1,
56 check_z_buffer_addr_mode,
57 check_destination_addr0,
58 check_destination_addr1,
59 check_destination_addr_mode,
60 check_for_dummy,
61 check_for_dd,
62 check_texture_addr0,
63 check_texture_addr1,
64 check_texture_addr2,
65 check_texture_addr3,
66 check_texture_addr4,
67 check_texture_addr5,
68 check_texture_addr6,
69 check_texture_addr7,
70 check_texture_addr8,
71 check_texture_addr_mode,
72 check_for_vertex_count,
73 check_number_texunits,
74 forbidden_command
75} hazard_t;
76
77/*
78 * Associates each hazard above with a possible multi-command
79 * sequence. For example an address that is split over multiple
80 * commands and that needs to be checked at the first command
81 * that does not include any part of the address.
82 */
83
84static drm_via_sequence_t seqs[] = {
85 no_sequence,
86 no_sequence,
87 no_sequence,
88 no_sequence,
89 no_sequence,
90 no_sequence,
91 z_address,
92 z_address,
93 z_address,
94 dest_address,
95 dest_address,
96 dest_address,
97 no_sequence,
98 no_sequence,
99 tex_address,
100 tex_address,
101 tex_address,
102 tex_address,
103 tex_address,
104 tex_address,
105 tex_address,
106 tex_address,
107 tex_address,
108 tex_address,
109 no_sequence
110};
111
112typedef struct {
113 unsigned int code;
114 hazard_t hz;
115} hz_init_t;
116
117static hz_init_t init_table1[] = {
118 {0xf2, check_for_header2_err},
119 {0xf0, check_for_header1_err},
120 {0xee, check_for_fire},
121 {0xcc, check_for_dummy},
122 {0xdd, check_for_dd},
123 {0x00, no_check},
124 {0x10, check_z_buffer_addr0},
125 {0x11, check_z_buffer_addr1},
126 {0x12, check_z_buffer_addr_mode},
127 {0x13, no_check},
128 {0x14, no_check},
129 {0x15, no_check},
130 {0x23, no_check},
131 {0x24, no_check},
132 {0x33, no_check},
133 {0x34, no_check},
134 {0x35, no_check},
135 {0x36, no_check},
136 {0x37, no_check},
137 {0x38, no_check},
138 {0x39, no_check},
139 {0x3A, no_check},
140 {0x3B, no_check},
141 {0x3C, no_check},
142 {0x3D, no_check},
143 {0x3E, no_check},
144 {0x40, check_destination_addr0},
145 {0x41, check_destination_addr1},
146 {0x42, check_destination_addr_mode},
147 {0x43, no_check},
148 {0x44, no_check},
149 {0x50, no_check},
150 {0x51, no_check},
151 {0x52, no_check},
152 {0x53, no_check},
153 {0x54, no_check},
154 {0x55, no_check},
155 {0x56, no_check},
156 {0x57, no_check},
157 {0x58, no_check},
158 {0x70, no_check},
159 {0x71, no_check},
160 {0x78, no_check},
161 {0x79, no_check},
162 {0x7A, no_check},
163 {0x7B, no_check},
164 {0x7C, no_check},
165 {0x7D, check_for_vertex_count}
166};
167
168static hz_init_t init_table2[] = {
169 {0xf2, check_for_header2_err},
170 {0xf0, check_for_header1_err},
171 {0xee, check_for_fire},
172 {0xcc, check_for_dummy},
173 {0x00, check_texture_addr0},
174 {0x01, check_texture_addr0},
175 {0x02, check_texture_addr0},
176 {0x03, check_texture_addr0},
177 {0x04, check_texture_addr0},
178 {0x05, check_texture_addr0},
179 {0x06, check_texture_addr0},
180 {0x07, check_texture_addr0},
181 {0x08, check_texture_addr0},
182 {0x09, check_texture_addr0},
183 {0x20, check_texture_addr1},
184 {0x21, check_texture_addr1},
185 {0x22, check_texture_addr1},
186 {0x23, check_texture_addr4},
187 {0x2B, check_texture_addr3},
188 {0x2C, check_texture_addr3},
189 {0x2D, check_texture_addr3},
190 {0x2E, check_texture_addr3},
191 {0x2F, check_texture_addr3},
192 {0x30, check_texture_addr3},
193 {0x31, check_texture_addr3},
194 {0x32, check_texture_addr3},
195 {0x33, check_texture_addr3},
196 {0x34, check_texture_addr3},
197 {0x4B, check_texture_addr5},
198 {0x4C, check_texture_addr6},
199 {0x51, check_texture_addr7},
200 {0x52, check_texture_addr8},
201 {0x77, check_texture_addr2},
202 {0x78, no_check},
203 {0x79, no_check},
204 {0x7A, no_check},
205 {0x7B, check_texture_addr_mode},
206 {0x7C, no_check},
207 {0x7D, no_check},
208 {0x7E, no_check},
209 {0x7F, no_check},
210 {0x80, no_check},
211 {0x81, no_check},
212 {0x82, no_check},
213 {0x83, no_check},
214 {0x85, no_check},
215 {0x86, no_check},
216 {0x87, no_check},
217 {0x88, no_check},
218 {0x89, no_check},
219 {0x8A, no_check},
220 {0x90, no_check},
221 {0x91, no_check},
222 {0x92, no_check},
223 {0x93, no_check}
224};
225
226static hz_init_t init_table3[] = {
227 {0xf2, check_for_header2_err},
228 {0xf0, check_for_header1_err},
229 {0xcc, check_for_dummy},
230 {0x00, check_number_texunits}
231};
232
233static hazard_t table1[256];
234static hazard_t table2[256];
235static hazard_t table3[256];
236
237static __inline__ int
238eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
239{
240 if ((buf_end - *buf) >= num_words) {
241 *buf += num_words;
242 return 0;
243 }
244 DRM_ERROR("Illegal termination of DMA command buffer\n");
245 return 1;
246}
247
248/*
249 * Partially stolen from drm_memory.h
250 */
251
252static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
253 unsigned long offset,
254 unsigned long size,
255 drm_device_t * dev)
256{
257 struct list_head *list;
258 drm_map_list_t *r_list;
259 drm_local_map_t *map = seq->map_cache;
260
261 if (map && map->offset <= offset
262 && (offset + size) <= (map->offset + map->size)) {
263 return map;
264 }
265
266 list_for_each(list, &dev->maplist->head) {
267 r_list = (drm_map_list_t *) list;
268 map = r_list->map;
269 if (!map)
270 continue;
271 if (map->offset <= offset
272 && (offset + size) <= (map->offset + map->size)
273 && !(map->flags & _DRM_RESTRICTED)
274 && (map->type == _DRM_AGP)) {
275 seq->map_cache = map;
276 return map;
277 }
278 }
279 return NULL;
280}
281
282/*
283 * Require that all AGP texture levels reside in the same AGP map which should
284 * be mappable by the client. This is not a big restriction.
285 * FIXME: To actually enforce this security policy strictly, drm_rmmap
286 * would have to wait for dma quiescent before removing an AGP map.
287 * The via_drm_lookup_agp_map call in reality seems to take
288 * very little CPU time.
289 */
290
291static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
292{
293 switch (cur_seq->unfinished) {
294 case z_address:
295 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
296 break;
297 case dest_address:
298 DRM_DEBUG("Destination start address is 0x%x\n",
299 cur_seq->d_addr);
300 break;
301 case tex_address:
302 if (cur_seq->agp_texture) {
303 unsigned start =
304 cur_seq->tex_level_lo[cur_seq->texture];
305 unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
306 unsigned long lo = ~0, hi = 0, tmp;
307 uint32_t *addr, *pitch, *height, tex;
308 unsigned i;
309
310 if (end > 9)
311 end = 9;
312 if (start > 9)
313 start = 9;
314
315 addr =
316 &(cur_seq->t_addr[tex = cur_seq->texture][start]);
317 pitch = &(cur_seq->pitch[tex][start]);
318 height = &(cur_seq->height[tex][start]);
319
320 for (i = start; i <= end; ++i) {
321 tmp = *addr++;
322 if (tmp < lo)
323 lo = tmp;
324 tmp += (*height++ << *pitch++);
325 if (tmp > hi)
326 hi = tmp;
327 }
328
329 if (!via_drm_lookup_agp_map
330 (cur_seq, lo, hi - lo, cur_seq->dev)) {
331 DRM_ERROR
332 ("AGP texture is not in allowed map\n");
333 return 2;
334 }
335 }
336 break;
337 default:
338 break;
339 }
340 cur_seq->unfinished = no_sequence;
341 return 0;
342}
343
344static __inline__ int
345investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
346{
347 register uint32_t tmp, *tmp_addr;
348
349 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
350 int ret;
351 if ((ret = finish_current_sequence(cur_seq)))
352 return ret;
353 }
354
355 switch (hz) {
356 case check_for_header2:
357 if (cmd == HALCYON_HEADER2)
358 return 1;
359 return 0;
360 case check_for_header1:
361 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
362 return 1;
363 return 0;
364 case check_for_header2_err:
365 if (cmd == HALCYON_HEADER2)
366 return 1;
367 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
368 break;
369 case check_for_header1_err:
370 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
371 return 1;
372 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
373 break;
374 case check_for_fire:
375 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
376 return 1;
377 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
378 break;
379 case check_for_dummy:
380 if (HC_DUMMY == cmd)
381 return 0;
382 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
383 break;
384 case check_for_dd:
385 if (0xdddddddd == cmd)
386 return 0;
387 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
388 break;
389 case check_z_buffer_addr0:
390 cur_seq->unfinished = z_address;
391 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
392 (cmd & 0x00FFFFFF);
393 return 0;
394 case check_z_buffer_addr1:
395 cur_seq->unfinished = z_address;
396 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
397 ((cmd & 0xFF) << 24);
398 return 0;
399 case check_z_buffer_addr_mode:
400 cur_seq->unfinished = z_address;
401 if ((cmd & 0x0000C000) == 0)
402 return 0;
403 DRM_ERROR("Attempt to place Z buffer in system memory\n");
404 return 2;
405 case check_destination_addr0:
406 cur_seq->unfinished = dest_address;
407 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
408 (cmd & 0x00FFFFFF);
409 return 0;
410 case check_destination_addr1:
411 cur_seq->unfinished = dest_address;
412 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
413 ((cmd & 0xFF) << 24);
414 return 0;
415 case check_destination_addr_mode:
416 cur_seq->unfinished = dest_address;
417 if ((cmd & 0x0000C000) == 0)
418 return 0;
419 DRM_ERROR
420 ("Attempt to place 3D drawing buffer in system memory\n");
421 return 2;
422 case check_texture_addr0:
423 cur_seq->unfinished = tex_address;
424 tmp = (cmd >> 24);
425 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
426 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
427 return 0;
428 case check_texture_addr1:
429 cur_seq->unfinished = tex_address;
430 tmp = ((cmd >> 24) - 0x20);
431 tmp += tmp << 1;
432 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
433 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
434 tmp_addr++;
435 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
436 tmp_addr++;
437 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
438 return 0;
439 case check_texture_addr2:
440 cur_seq->unfinished = tex_address;
441 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
442 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
443 return 0;
444 case check_texture_addr3:
445 cur_seq->unfinished = tex_address;
446 tmp = ((cmd >> 24) - 0x2B);
447 cur_seq->pitch[cur_seq->texture][tmp] =
448 (cmd & 0x00F00000) >> 20;
449 if (!tmp && (cmd & 0x000FFFFF)) {
450 DRM_ERROR
451 ("Unimplemented texture level 0 pitch mode.\n");
452 return 2;
453 }
454 return 0;
455 case check_texture_addr4:
456 cur_seq->unfinished = tex_address;
457 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
458 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
459 return 0;
460 case check_texture_addr5:
461 case check_texture_addr6:
462 cur_seq->unfinished = tex_address;
463 /*
464 * Texture width. We don't care since we have the pitch.
465 */
466 return 0;
467 case check_texture_addr7:
468 cur_seq->unfinished = tex_address;
469 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
470 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
471 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
472 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
473 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
474 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
475 tmp_addr[0] = 1 << (cmd & 0x0000000F);
476 return 0;
477 case check_texture_addr8:
478 cur_seq->unfinished = tex_address;
479 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
480 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
481 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
482 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
483 tmp_addr[6] = 1 << (cmd & 0x0000000F);
484 return 0;
485 case check_texture_addr_mode:
486 cur_seq->unfinished = tex_address;
487 if (2 == (tmp = cmd & 0x00000003)) {
488 DRM_ERROR
489 ("Attempt to fetch texture from system memory.\n");
490 return 2;
491 }
492 cur_seq->agp_texture = (tmp == 3);
493 cur_seq->tex_palette_size[cur_seq->texture] =
494 (cmd >> 16) & 0x000000007;
495 return 0;
496 case check_for_vertex_count:
497 cur_seq->vertex_count = cmd & 0x0000FFFF;
498 return 0;
499 case check_number_texunits:
500 cur_seq->multitex = (cmd >> 3) & 1;
501 return 0;
502 default:
503 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
504 return 2;
505 }
506 return 2;
507}
508
509static __inline__ int
510via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
511 drm_via_state_t * cur_seq)
512{
513 drm_via_private_t *dev_priv =
514 (drm_via_private_t *) cur_seq->dev->dev_private;
515 uint32_t a_fire, bcmd, dw_count;
516 int ret = 0;
517 int have_fire;
518 const uint32_t *buf = *buffer;
519
520 while (buf < buf_end) {
521 have_fire = 0;
522 if ((buf_end - buf) < 2) {
523 DRM_ERROR
524 ("Unexpected termination of primitive list.\n");
525 ret = 1;
526 break;
527 }
528 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
529 break;
530 bcmd = *buf++;
531 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
532 DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
533 *buf);
534 ret = 1;
535 break;
536 }
537 a_fire =
538 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
539 HC_HE3Fire_MASK;
540
541 /*
542 * How many dwords per vertex ?
543 */
544
545 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
546 DRM_ERROR("Illegal B command vertex data for AGP.\n");
547 ret = 1;
548 break;
549 }
550
551 dw_count = 0;
552 if (bcmd & (1 << 7))
553 dw_count += (cur_seq->multitex) ? 2 : 1;
554 if (bcmd & (1 << 8))
555 dw_count += (cur_seq->multitex) ? 2 : 1;
556 if (bcmd & (1 << 9))
557 dw_count++;
558 if (bcmd & (1 << 10))
559 dw_count++;
560 if (bcmd & (1 << 11))
561 dw_count++;
562 if (bcmd & (1 << 12))
563 dw_count++;
564 if (bcmd & (1 << 13))
565 dw_count++;
566 if (bcmd & (1 << 14))
567 dw_count++;
568
569 while (buf < buf_end) {
570 if (*buf == a_fire) {
571 if (dev_priv->num_fire_offsets >=
572 VIA_FIRE_BUF_SIZE) {
573 DRM_ERROR("Fire offset buffer full.\n");
574 ret = 1;
575 break;
576 }
577 dev_priv->fire_offsets[dev_priv->
578 num_fire_offsets++] =
579 buf;
580 have_fire = 1;
581 buf++;
582 if (buf < buf_end && *buf == a_fire)
583 buf++;
584 break;
585 }
586 if ((*buf == HALCYON_HEADER2) ||
587 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
588 DRM_ERROR("Missing Vertex Fire command, "
589 "Stray Vertex Fire command or verifier "
590 "lost sync.\n");
591 ret = 1;
592 break;
593 }
594 if ((ret = eat_words(&buf, buf_end, dw_count)))
595 break;
596 }
597 if (buf >= buf_end && !have_fire) {
598 DRM_ERROR("Missing Vertex Fire command or verifier "
599 "lost sync.\n");
600 ret = 1;
601 break;
602 }
603 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
604 DRM_ERROR("AGP Primitive list end misaligned.\n");
605 ret = 1;
606 break;
607 }
608 }
609 *buffer = buf;
610 return ret;
611}
612
613static __inline__ verifier_state_t
614via_check_header2(uint32_t const **buffer, const uint32_t * buf_end,
615 drm_via_state_t * hc_state)
616{
617 uint32_t cmd;
618 int hz_mode;
619 hazard_t hz;
620 const uint32_t *buf = *buffer;
621 const hazard_t *hz_table;
622
623 if ((buf_end - buf) < 2) {
624 DRM_ERROR
625 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
626 return state_error;
627 }
628 buf++;
629 cmd = (*buf++ & 0xFFFF0000) >> 16;
630
631 switch (cmd) {
632 case HC_ParaType_CmdVdata:
633 if (via_check_prim_list(&buf, buf_end, hc_state))
634 return state_error;
635 *buffer = buf;
636 return state_command;
637 case HC_ParaType_NotTex:
638 hz_table = table1;
639 break;
640 case HC_ParaType_Tex:
641 hc_state->texture = 0;
642 hz_table = table2;
643 break;
644 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
645 hc_state->texture = 1;
646 hz_table = table2;
647 break;
648 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
649 hz_table = table3;
650 break;
651 case HC_ParaType_Auto:
652 if (eat_words(&buf, buf_end, 2))
653 return state_error;
654 *buffer = buf;
655 return state_command;
656 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
657 if (eat_words(&buf, buf_end, 32))
658 return state_error;
659 *buffer = buf;
660 return state_command;
661 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
662 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
663 DRM_ERROR("Texture palettes are rejected because of "
664 "lack of info how to determine their size.\n");
665 return state_error;
666 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
667 DRM_ERROR("Fog factor palettes are rejected because of "
668 "lack of info how to determine their size.\n");
669 return state_error;
670 default:
671
672 /*
673 * There are some unimplemented HC_ParaTypes here, that
674 * need to be implemented if the Mesa driver is extended.
675 */
676
677 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
678 "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
679 cmd, *(buf - 2));
680 *buffer = buf;
681 return state_error;
682 }
683
684 while (buf < buf_end) {
685 cmd = *buf++;
686 if ((hz = hz_table[cmd >> 24])) {
687 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
688 if (hz_mode == 1) {
689 buf--;
690 break;
691 }
692 return state_error;
693 }
694 } else if (hc_state->unfinished &&
695 finish_current_sequence(hc_state)) {
696 return state_error;
697 }
698 }
699 if (hc_state->unfinished && finish_current_sequence(hc_state)) {
700 return state_error;
701 }
702 *buffer = buf;
703 return state_command;
704}
705
706static __inline__ verifier_state_t
707via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer,
708 const uint32_t * buf_end, int *fire_count)
709{
710 uint32_t cmd;
711 const uint32_t *buf = *buffer;
712 const uint32_t *next_fire;
713 int burst = 0;
714
715 next_fire = dev_priv->fire_offsets[*fire_count];
716 buf++;
717 cmd = (*buf & 0xFFFF0000) >> 16;
718 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
719 switch (cmd) {
720 case HC_ParaType_CmdVdata:
721 while ((buf < buf_end) &&
722 (*fire_count < dev_priv->num_fire_offsets) &&
723 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
724 while (buf <= next_fire) {
725 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
726 (burst & 63), *buf++);
727 burst += 4;
728 }
729 if ((buf < buf_end)
730 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
731 buf++;
732
733 if (++(*fire_count) < dev_priv->num_fire_offsets)
734 next_fire = dev_priv->fire_offsets[*fire_count];
735 }
736 break;
737 default:
738 while (buf < buf_end) {
739
740 if (*buf == HC_HEADER2 ||
741 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
742 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
743 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
744 break;
745
746 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
747 (burst & 63), *buf++);
748 burst += 4;
749 }
750 }
751 *buffer = buf;
752 return state_command;
753}
754
755static __inline__ int verify_mmio_address(uint32_t address)
756{
757 if ((address > 0x3FF) && (address < 0xC00)) {
758 DRM_ERROR("Invalid VIDEO DMA command. "
759 "Attempt to access 3D- or command burst area.\n");
760 return 1;
761 } else if ((address > 0xCFF) && (address < 0x1300)) {
762 DRM_ERROR("Invalid VIDEO DMA command. "
763 "Attempt to access PCI DMA area.\n");
764 return 1;
765 } else if (address > 0x13FF) {
766 DRM_ERROR("Invalid VIDEO DMA command. "
767 "Attempt to access VGA registers.\n");
768 return 1;
769 }
770 return 0;
771}
772
773static __inline__ int
774verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
775 uint32_t dwords)
776{
777 const uint32_t *buf = *buffer;
778
779 if (buf_end - buf < dwords) {
780 DRM_ERROR("Illegal termination of video command.\n");
781 return 1;
782 }
783 while (dwords--) {
784 if (*buf++) {
785 DRM_ERROR("Illegal video command tail.\n");
786 return 1;
787 }
788 }
789 *buffer = buf;
790 return 0;
791}
792
793static __inline__ verifier_state_t
794via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
795{
796 uint32_t cmd;
797 const uint32_t *buf = *buffer;
798 verifier_state_t ret = state_command;
799
800 while (buf < buf_end) {
801 cmd = *buf;
802 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
803 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
804 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
805 break;
806 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
807 "Attempt to access 3D- or command burst area.\n");
808 ret = state_error;
809 break;
810 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
811 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
812 break;
813 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
814 "Attempt to access VGA registers.\n");
815 ret = state_error;
816 break;
817 } else {
818 buf += 2;
819 }
820 }
821 *buffer = buf;
822 return ret;
823}
824
825static __inline__ verifier_state_t
826via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer,
827 const uint32_t * buf_end)
828{
829 register uint32_t cmd;
830 const uint32_t *buf = *buffer;
831
832 while (buf < buf_end) {
833 cmd = *buf;
834 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
835 break;
836 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
837 buf++;
838 }
839 *buffer = buf;
840 return state_command;
841}
842
843static __inline__ verifier_state_t
844via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end)
845{
846 uint32_t data;
847 const uint32_t *buf = *buffer;
848
849 if (buf_end - buf < 4) {
850 DRM_ERROR("Illegal termination of video header5 command\n");
851 return state_error;
852 }
853
854 data = *buf++ & ~VIA_VIDEOMASK;
855 if (verify_mmio_address(data))
856 return state_error;
857
858 data = *buf++;
859 if (*buf++ != 0x00F50000) {
860 DRM_ERROR("Illegal header5 header data\n");
861 return state_error;
862 }
863 if (*buf++ != 0x00000000) {
864 DRM_ERROR("Illegal header5 header data\n");
865 return state_error;
866 }
867 if (eat_words(&buf, buf_end, data))
868 return state_error;
869 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
870 return state_error;
871 *buffer = buf;
872 return state_command;
873
874}
875
876static __inline__ verifier_state_t
877via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer,
878 const uint32_t * buf_end)
879{
880 uint32_t addr, count, i;
881 const uint32_t *buf = *buffer;
882
883 addr = *buf++ & ~VIA_VIDEOMASK;
884 i = count = *buf;
885 buf += 3;
886 while (i--) {
887 VIA_WRITE(addr, *buf++);
888 }
889 if (count & 3)
890 buf += 4 - (count & 3);
891 *buffer = buf;
892 return state_command;
893}
894
895static __inline__ verifier_state_t
896via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
897{
898 uint32_t data;
899 const uint32_t *buf = *buffer;
900 uint32_t i;
901
902 if (buf_end - buf < 4) {
903 DRM_ERROR("Illegal termination of video header6 command\n");
904 return state_error;
905 }
906 buf++;
907 data = *buf++;
908 if (*buf++ != 0x00F60000) {
909 DRM_ERROR("Illegal header6 header data\n");
910 return state_error;
911 }
912 if (*buf++ != 0x00000000) {
913 DRM_ERROR("Illegal header6 header data\n");
914 return state_error;
915 }
916 if ((buf_end - buf) < (data << 1)) {
917 DRM_ERROR("Illegal termination of video header6 command\n");
918 return state_error;
919 }
920 for (i = 0; i < data; ++i) {
921 if (verify_mmio_address(*buf++))
922 return state_error;
923 buf++;
924 }
925 data <<= 1;
926 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
927 return state_error;
928 *buffer = buf;
929 return state_command;
930}
931
932static __inline__ verifier_state_t
933via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer,
934 const uint32_t * buf_end)
935{
936
937 uint32_t addr, count, i;
938 const uint32_t *buf = *buffer;
939
940 i = count = *++buf;
941 buf += 3;
942 while (i--) {
943 addr = *buf++;
944 VIA_WRITE(addr, *buf++);
945 }
946 count <<= 1;
947 if (count & 3)
948 buf += 4 - (count & 3);
949 *buffer = buf;
950 return state_command;
951}
952
953int
954via_verify_command_stream(const uint32_t * buf, unsigned int size,
955 drm_device_t * dev, int agp)
956{
957
958 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
959 drm_via_state_t *hc_state = &dev_priv->hc_state;
960 drm_via_state_t saved_state = *hc_state;
961 uint32_t cmd;
962 const uint32_t *buf_end = buf + (size >> 2);
963 verifier_state_t state = state_command;
964 int pro_group_a = dev_priv->pro_group_a;
965
966 hc_state->dev = dev;
967 hc_state->unfinished = no_sequence;
968 hc_state->map_cache = NULL;
969 hc_state->agp = agp;
970 hc_state->buf_start = buf;
971 dev_priv->num_fire_offsets = 0;
972
973 while (buf < buf_end) {
974
975 switch (state) {
976 case state_header2:
977 state = via_check_header2(&buf, buf_end, hc_state);
978 break;
979 case state_header1:
980 state = via_check_header1(&buf, buf_end);
981 break;
982 case state_vheader5:
983 state = via_check_vheader5(&buf, buf_end);
984 break;
985 case state_vheader6:
986 state = via_check_vheader6(&buf, buf_end);
987 break;
988 case state_command:
989 if (HALCYON_HEADER2 == (cmd = *buf))
990 state = state_header2;
991 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
992 state = state_header1;
993 else if (pro_group_a
994 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
995 state = state_vheader5;
996 else if (pro_group_a
997 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
998 state = state_vheader6;
999 else {
1000 DRM_ERROR
1001 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1002 cmd);
1003 state = state_error;
1004 }
1005 break;
1006 case state_error:
1007 default:
1008 *hc_state = saved_state;
1009 return DRM_ERR(EINVAL);
1010 }
1011 }
1012 if (state == state_error) {
1013 *hc_state = saved_state;
1014 return DRM_ERR(EINVAL);
1015 }
1016 return 0;
1017}
1018
1019int
1020via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
1021 unsigned int size)
1022{
1023
1024 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1025 uint32_t cmd;
1026 const uint32_t *buf_end = buf + (size >> 2);
1027 verifier_state_t state = state_command;
1028 int fire_count = 0;
1029
1030 while (buf < buf_end) {
1031
1032 switch (state) {
1033 case state_header2:
1034 state =
1035 via_parse_header2(dev_priv, &buf, buf_end,
1036 &fire_count);
1037 break;
1038 case state_header1:
1039 state = via_parse_header1(dev_priv, &buf, buf_end);
1040 break;
1041 case state_vheader5:
1042 state = via_parse_vheader5(dev_priv, &buf, buf_end);
1043 break;
1044 case state_vheader6:
1045 state = via_parse_vheader6(dev_priv, &buf, buf_end);
1046 break;
1047 case state_command:
1048 if (HALCYON_HEADER2 == (cmd = *buf))
1049 state = state_header2;
1050 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1051 state = state_header1;
1052 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1053 state = state_vheader5;
1054 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1055 state = state_vheader6;
1056 else {
1057 DRM_ERROR
1058 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1059 cmd);
1060 state = state_error;
1061 }
1062 break;
1063 case state_error:
1064 default:
1065 return DRM_ERR(EINVAL);
1066 }
1067 }
1068 if (state == state_error) {
1069 return DRM_ERR(EINVAL);
1070 }
1071 return 0;
1072}
1073
1074static void
1075setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1076{
1077 int i;
1078
1079 for (i = 0; i < 256; ++i) {
1080 table[i] = forbidden_command;
1081 }
1082
1083 for (i = 0; i < size; ++i) {
1084 table[init_table[i].code] = init_table[i].hz;
1085 }
1086}
1087
1088void via_init_command_verifier(void)
1089{
1090 setup_hazard_table(init_table1, table1,
1091 sizeof(init_table1) / sizeof(hz_init_t));
1092 setup_hazard_table(init_table2, table2,
1093 sizeof(init_table2) / sizeof(hz_init_t));
1094 setup_hazard_table(init_table3, table3,
1095 sizeof(init_table3) / sizeof(hz_init_t));
1096}