]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/gpu/drm/via/via_verifier.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph...
[mirror_ubuntu-bionic-kernel.git] / drivers / gpu / drm / via / via_verifier.c
CommitLineData
22f579c6
DA		 1/*
2 * Copyright 2004 The Unichrome Project. All Rights Reserved.
3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sub license,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial portions
14 * of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 * DEALINGS IN THE SOFTWARE.
23 *
24 * Author: Thomas Hellstrom 2004, 2005.
25 * This code was written using docs obtained under NDA from VIA Inc.
26 *
27 * Don't run this code directly on an AGP buffer. Due to cache problems it will
28 * be very slow.
29 */
30
22f579c6 31#include "via_3d_reg.h"
760285e7
DH		 32#include <drm/drmP.h>
33#include <drm/via_drm.h>
22f579c6
DA		 34#include "via_verifier.h"
35#include "via_drv.h"
36
b5e89ed5 37typedef enum {
22f579c6
DA		 38 state_command,
39 state_header2,
40 state_header1,
41 state_vheader5,
42 state_vheader6,
43 state_error
44} verifier_state_t;
45
b5e89ed5 46typedef enum {
22f579c6
DA		 47 no_check = 0,
48 check_for_header2,
49 check_for_header1,
50 check_for_header2_err,
51 check_for_header1_err,
52 check_for_fire,
53 check_z_buffer_addr0,
54 check_z_buffer_addr1,
55 check_z_buffer_addr_mode,
56 check_destination_addr0,
57 check_destination_addr1,
58 check_destination_addr_mode,
59 check_for_dummy,
60 check_for_dd,
61 check_texture_addr0,
62 check_texture_addr1,
63 check_texture_addr2,
64 check_texture_addr3,
65 check_texture_addr4,
66 check_texture_addr5,
67 check_texture_addr6,
68 check_texture_addr7,
69 check_texture_addr8,
70 check_texture_addr_mode,
71 check_for_vertex_count,
72 check_number_texunits,
73 forbidden_command
b5e89ed5 74} hazard_t;
22f579c6
DA		 75
76/*
77 * Associates each hazard above with a possible multi-command
78 * sequence. For example an address that is split over multiple
b5e89ed5 79 * commands and that needs to be checked at the first command
22f579c6
DA		 80 * that does not include any part of the address.
81 */
82
b5e89ed5 83static drm_via_sequence_t seqs[] = {
22f579c6
DA		 84 no_sequence,
85 no_sequence,
86 no_sequence,
87 no_sequence,
88 no_sequence,
89 no_sequence,
90 z_address,
91 z_address,
92 z_address,
93 dest_address,
94 dest_address,
95 dest_address,
96 no_sequence,
97 no_sequence,
98 tex_address,
99 tex_address,
100 tex_address,
101 tex_address,
102 tex_address,
103 tex_address,
104 tex_address,
105 tex_address,
106 tex_address,
107 tex_address,
108 no_sequence
109};
b5e89ed5
DA		 110
111typedef struct {
22f579c6
DA		 112 unsigned int code;
113 hazard_t hz;
114} hz_init_t;
115
22f579c6
DA		 116static hz_init_t init_table1[] = {
117 {0xf2, check_for_header2_err},
118 {0xf0, check_for_header1_err},
119 {0xee, check_for_fire},
120 {0xcc, check_for_dummy},
121 {0xdd, check_for_dd},
122 {0x00, no_check},
123 {0x10, check_z_buffer_addr0},
124 {0x11, check_z_buffer_addr1},
125 {0x12, check_z_buffer_addr_mode},
126 {0x13, no_check},
127 {0x14, no_check},
128 {0x15, no_check},
129 {0x23, no_check},
130 {0x24, no_check},
131 {0x33, no_check},
132 {0x34, no_check},
133 {0x35, no_check},
134 {0x36, no_check},
135 {0x37, no_check},
136 {0x38, no_check},
137 {0x39, no_check},
138 {0x3A, no_check},
139 {0x3B, no_check},
140 {0x3C, no_check},
141 {0x3D, no_check},
142 {0x3E, no_check},
143 {0x40, check_destination_addr0},
144 {0x41, check_destination_addr1},
145 {0x42, check_destination_addr_mode},
146 {0x43, no_check},
147 {0x44, no_check},
148 {0x50, no_check},
149 {0x51, no_check},
150 {0x52, no_check},
151 {0x53, no_check},
152 {0x54, no_check},
153 {0x55, no_check},
154 {0x56, no_check},
155 {0x57, no_check},
156 {0x58, no_check},
157 {0x70, no_check},
158 {0x71, no_check},
159 {0x78, no_check},
160 {0x79, no_check},
161 {0x7A, no_check},
162 {0x7B, no_check},
163 {0x7C, no_check},
164 {0x7D, check_for_vertex_count}
165};
166
22f579c6
DA		 167static hz_init_t init_table2[] = {
168 {0xf2, check_for_header2_err},
169 {0xf0, check_for_header1_err},
170 {0xee, check_for_fire},
171 {0xcc, check_for_dummy},
172 {0x00, check_texture_addr0},
173 {0x01, check_texture_addr0},
174 {0x02, check_texture_addr0},
175 {0x03, check_texture_addr0},
176 {0x04, check_texture_addr0},
177 {0x05, check_texture_addr0},
178 {0x06, check_texture_addr0},
179 {0x07, check_texture_addr0},
180 {0x08, check_texture_addr0},
181 {0x09, check_texture_addr0},
182 {0x20, check_texture_addr1},
183 {0x21, check_texture_addr1},
184 {0x22, check_texture_addr1},
185 {0x23, check_texture_addr4},
186 {0x2B, check_texture_addr3},
187 {0x2C, check_texture_addr3},
188 {0x2D, check_texture_addr3},
189 {0x2E, check_texture_addr3},
190 {0x2F, check_texture_addr3},
191 {0x30, check_texture_addr3},
192 {0x31, check_texture_addr3},
193 {0x32, check_texture_addr3},
194 {0x33, check_texture_addr3},
195 {0x34, check_texture_addr3},
196 {0x4B, check_texture_addr5},
197 {0x4C, check_texture_addr6},
198 {0x51, check_texture_addr7},
199 {0x52, check_texture_addr8},
200 {0x77, check_texture_addr2},
201 {0x78, no_check},
202 {0x79, no_check},
203 {0x7A, no_check},
204 {0x7B, check_texture_addr_mode},
205 {0x7C, no_check},
206 {0x7D, no_check},
207 {0x7E, no_check},
208 {0x7F, no_check},
209 {0x80, no_check},
210 {0x81, no_check},
211 {0x82, no_check},
212 {0x83, no_check},
213 {0x85, no_check},
214 {0x86, no_check},
215 {0x87, no_check},
216 {0x88, no_check},
217 {0x89, no_check},
218 {0x8A, no_check},
219 {0x90, no_check},
220 {0x91, no_check},
221 {0x92, no_check},
222 {0x93, no_check}
223};
224
225static hz_init_t init_table3[] = {
226 {0xf2, check_for_header2_err},
227 {0xf0, check_for_header1_err},
228 {0xcc, check_for_dummy},
229 {0x00, check_number_texunits}
230};
22f579c6 231
b5e89ed5
DA		 232static hazard_t table1[256];
233static hazard_t table2[256];
234static hazard_t table3[256];
22f579c6
DA		 235
236static __inline__ int
58c1e85a 237eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
22f579c6 238{
92514243 239 if ((buf_end - *buf) >= num_words) {
22f579c6
DA		 240 *buf += num_words;
241 return 0;
b5e89ed5 242 }
22f579c6
DA		 243 DRM_ERROR("Illegal termination of DMA command buffer\n");
244 return 1;
245}
246
22f579c6
DA		 247/*
248 * Partially stolen from drm_memory.h
249 */
250
92514243 251static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
b5e89ed5
DA		 252 unsigned long offset,
253 unsigned long size,
58c1e85a 254 struct drm_device *dev)
22f579c6 255{
55910517 256 struct drm_map_list *r_list;
92514243 257 drm_local_map_t *map = seq->map_cache;
22f579c6 258
b5e89ed5
DA		 259 if (map && map->offset <= offset
260 && (offset + size) <= (map->offset + map->size)) {
22f579c6
DA		 261 return map;
262 }
b5e89ed5 263
bd1b331f 264 list_for_each_entry(r_list, &dev->maplist, head) {
22f579c6
DA		 265 map = r_list->map;
266 if (!map)
267 continue;
b5e89ed5
DA		 268 if (map->offset <= offset
269 && (offset + size) <= (map->offset + map->size)
270 && !(map->flags & _DRM_RESTRICTED)
271 && (map->type == _DRM_AGP)) {
22f579c6
DA		 272 seq->map_cache = map;
273 return map;
274 }
275 }
276 return NULL;
277}
278
22f579c6 279/*
b5e89ed5 280 * Require that all AGP texture levels reside in the same AGP map which should
22f579c6 281 * be mappable by the client. This is not a big restriction.
b5e89ed5
DA		 282 * FIXME: To actually enforce this security policy strictly, drm_rmmap
283 * would have to wait for dma quiescent before removing an AGP map.
22f579c6
DA		 284 * The via_drm_lookup_agp_map call in reality seems to take
285 * very little CPU time.
286 */
287
b5e89ed5 288static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
22f579c6 289{
b5e89ed5 290 switch (cur_seq->unfinished) {
22f579c6
DA		 291 case z_address:
292 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
293 break;
294 case dest_address:
b5e89ed5
DA		 295 DRM_DEBUG("Destination start address is 0x%x\n",
296 cur_seq->d_addr);
22f579c6
DA		 297 break;
298 case tex_address:
b5e89ed5
DA		 299 if (cur_seq->agp_texture) {
300 unsigned start =
301 cur_seq->tex_level_lo[cur_seq->texture];
22f579c6 302 unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
b5e89ed5 303 unsigned long lo = ~0, hi = 0, tmp;
22f579c6
DA		 304 uint32_t *addr, *pitch, *height, tex;
305 unsigned i;
9b8d9d0e 306 int npot;
22f579c6 307
b5e89ed5
DA		 308 if (end > 9)
309 end = 9;
310 if (start > 9)
311 start = 9;
22f579c6 312
b5e89ed5
DA		 313 addr =
314 &(cur_seq->t_addr[tex = cur_seq->texture][start]);
22f579c6
DA		 315 pitch = &(cur_seq->pitch[tex][start]);
316 height = &(cur_seq->height[tex][start]);
9b8d9d0e 317 npot = cur_seq->tex_npot[tex];
b5e89ed5 318 for (i = start; i <= end; ++i) {
22f579c6 319 tmp = *addr++;
b5e89ed5
DA		 320 if (tmp < lo)
321 lo = tmp;
9b8d9d0e
TH		 322 if (i == 0 && npot)
323 tmp += (*height++ * *pitch++);
324 else
325 tmp += (*height++ << *pitch++);
b5e89ed5
DA		 326 if (tmp > hi)
327 hi = tmp;
22f579c6
DA		 328 }
329
b5e89ed5
DA		 330 if (!via_drm_lookup_agp_map
331 (cur_seq, lo, hi - lo, cur_seq->dev)) {
332 DRM_ERROR
333 ("AGP texture is not in allowed map\n");
22f579c6
DA		 334 return 2;
335 }
b5e89ed5 336 }
22f579c6
DA		 337 break;
338 default:
339 break;
340 }
341 cur_seq->unfinished = no_sequence;
342 return 0;
343}
344
b5e89ed5 345static __inline__ int
58c1e85a 346investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
22f579c6
DA		 347{
348 register uint32_t tmp, *tmp_addr;
349
350 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
351 int ret;
b5e89ed5
DA		 352 if ((ret = finish_current_sequence(cur_seq)))
353 return ret;
22f579c6
DA		 354 }
355
b5e89ed5 356 switch (hz) {
22f579c6 357 case check_for_header2:
b5e89ed5
DA		 358 if (cmd == HALCYON_HEADER2)
359 return 1;
22f579c6
DA		 360 return 0;
361 case check_for_header1:
b5e89ed5
DA		 362 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
363 return 1;
22f579c6
DA		 364 return 0;
365 case check_for_header2_err:
b5e89ed5
DA		 366 if (cmd == HALCYON_HEADER2)
367 return 1;
22f579c6
DA		 368 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
369 break;
370 case check_for_header1_err:
b5e89ed5
DA		 371 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
372 return 1;
22f579c6
DA		 373 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
374 break;
375 case check_for_fire:
b5e89ed5
DA		 376 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
377 return 1;
22f579c6
DA		 378 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
379 break;
380 case check_for_dummy:
b5e89ed5
DA		 381 if (HC_DUMMY == cmd)
382 return 0;
22f579c6
DA		 383 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
384 break;
385 case check_for_dd:
b5e89ed5
DA		 386 if (0xdddddddd == cmd)
387 return 0;
22f579c6
DA		 388 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
389 break;
390 case check_z_buffer_addr0:
391 cur_seq->unfinished = z_address;
392 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
b5e89ed5 393 (cmd & 0x00FFFFFF);
22f579c6
DA		 394 return 0;
395 case check_z_buffer_addr1:
396 cur_seq->unfinished = z_address;
397 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
b5e89ed5 398 ((cmd & 0xFF) << 24);
22f579c6
DA		 399 return 0;
400 case check_z_buffer_addr_mode:
401 cur_seq->unfinished = z_address;
b5e89ed5
DA		 402 if ((cmd & 0x0000C000) == 0)
403 return 0;
22f579c6
DA		 404 DRM_ERROR("Attempt to place Z buffer in system memory\n");
405 return 2;
406 case check_destination_addr0:
407 cur_seq->unfinished = dest_address;
408 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
b5e89ed5 409 (cmd & 0x00FFFFFF);
22f579c6
DA		 410 return 0;
411 case check_destination_addr1:
412 cur_seq->unfinished = dest_address;
413 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
b5e89ed5 414 ((cmd & 0xFF) << 24);
22f579c6
DA		 415 return 0;
416 case check_destination_addr_mode:
417 cur_seq->unfinished = dest_address;
b5e89ed5
DA		 418 if ((cmd & 0x0000C000) == 0)
419 return 0;
420 DRM_ERROR
421 ("Attempt to place 3D drawing buffer in system memory\n");
422 return 2;
22f579c6
DA		 423 case check_texture_addr0:
424 cur_seq->unfinished = tex_address;
425 tmp = (cmd >> 24);
426 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
427 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
428 return 0;
429 case check_texture_addr1:
430 cur_seq->unfinished = tex_address;
431 tmp = ((cmd >> 24) - 0x20);
432 tmp += tmp << 1;
433 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
434 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
435 tmp_addr++;
436 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
437 tmp_addr++;
438 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
439 return 0;
440 case check_texture_addr2:
441 cur_seq->unfinished = tex_address;
442 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
443 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
444 return 0;
445 case check_texture_addr3:
446 cur_seq->unfinished = tex_address;
9b8d9d0e
TH		 447 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
448 if (tmp == 0 &&
449 (cmd & HC_HTXnEnPit_MASK)) {
450 cur_seq->pitch[cur_seq->texture][tmp] =
451 (cmd & HC_HTXnLnPit_MASK);
452 cur_seq->tex_npot[cur_seq->texture] = 1;
453 } else {
454 cur_seq->pitch[cur_seq->texture][tmp] =
455 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
456 cur_seq->tex_npot[cur_seq->texture] = 0;
457 if (cmd & 0x000FFFFF) {
458 DRM_ERROR
459 ("Unimplemented texture level 0 pitch mode.\n");
460 return 2;
461 }
22f579c6
DA		 462 }
463 return 0;
464 case check_texture_addr4:
465 cur_seq->unfinished = tex_address;
466 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
467 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
468 return 0;
469 case check_texture_addr5:
470 case check_texture_addr6:
471 cur_seq->unfinished = tex_address;
472 /*
473 * Texture width. We don't care since we have the pitch.
b5e89ed5 474 */
22f579c6
DA		 475 return 0;
476 case check_texture_addr7:
477 cur_seq->unfinished = tex_address;
478 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
479 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
480 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
481 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
482 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
483 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
484 tmp_addr[0] = 1 << (cmd & 0x0000000F);
485 return 0;
486 case check_texture_addr8:
487 cur_seq->unfinished = tex_address;
488 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
489 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
b5e89ed5 490 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
22f579c6
DA		 491 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
492 tmp_addr[6] = 1 << (cmd & 0x0000000F);
493 return 0;
494 case check_texture_addr_mode:
495 cur_seq->unfinished = tex_address;
b5e89ed5
DA		 496 if (2 == (tmp = cmd & 0x00000003)) {
497 DRM_ERROR
498 ("Attempt to fetch texture from system memory.\n");
22f579c6
DA		 499 return 2;
500 }
501 cur_seq->agp_texture = (tmp == 3);
b5e89ed5
DA		 502 cur_seq->tex_palette_size[cur_seq->texture] =
503 (cmd >> 16) & 0x000000007;
22f579c6
DA		 504 return 0;
505 case check_for_vertex_count:
506 cur_seq->vertex_count = cmd & 0x0000FFFF;
507 return 0;
508 case check_number_texunits:
b5e89ed5 509 cur_seq->multitex = (cmd >> 3) & 1;
22f579c6
DA		 510 return 0;
511 default:
512 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
513 return 2;
514 }
515 return 2;
516}
517
22f579c6 518static __inline__ int
b5e89ed5 519via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
58c1e85a 520 drm_via_state_t *cur_seq)
22f579c6 521{
b5e89ed5
DA		 522 drm_via_private_t *dev_priv =
523 (drm_via_private_t *) cur_seq->dev->dev_private;
524 uint32_t a_fire, bcmd, dw_count;
22f579c6
DA		 525 int ret = 0;
526 int have_fire;
527 const uint32_t *buf = *buffer;
528
b5e89ed5
DA		 529 while (buf < buf_end) {
530 have_fire = 0;
22f579c6 531 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 532 DRM_ERROR
533 ("Unexpected termination of primitive list.\n");
22f579c6
DA		 534 ret = 1;
535 break;
536 }
b5e89ed5
DA		 537 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
538 break;
22f579c6
DA		 539 bcmd = *buf++;
540 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
541 DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
542 *buf);
543 ret = 1;
544 break;
545 }
b5e89ed5
DA		 546 a_fire =
547 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
548 HC_HE3Fire_MASK;
549
22f579c6
DA		 550 /*
551 * How many dwords per vertex ?
b5e89ed5
DA		 552 */
553
22f579c6
DA		 554 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
555 DRM_ERROR("Illegal B command vertex data for AGP.\n");
556 ret = 1;
557 break;
b5e89ed5 558 }
22f579c6
DA		 559
560 dw_count = 0;
b5e89ed5
DA		 561 if (bcmd & (1 << 7))
562 dw_count += (cur_seq->multitex) ? 2 : 1;
563 if (bcmd & (1 << 8))
564 dw_count += (cur_seq->multitex) ? 2 : 1;
565 if (bcmd & (1 << 9))
566 dw_count++;
567 if (bcmd & (1 << 10))
568 dw_count++;
569 if (bcmd & (1 << 11))
570 dw_count++;
571 if (bcmd & (1 << 12))
572 dw_count++;
573 if (bcmd & (1 << 13))
574 dw_count++;
575 if (bcmd & (1 << 14))
576 dw_count++;
577
578 while (buf < buf_end) {
22f579c6 579 if (*buf == a_fire) {
b5e89ed5
DA		 580 if (dev_priv->num_fire_offsets >=
581 VIA_FIRE_BUF_SIZE) {
22f579c6
DA		 582 DRM_ERROR("Fire offset buffer full.\n");
583 ret = 1;
584 break;
585 }
b5e89ed5
DA		 586 dev_priv->fire_offsets[dev_priv->
587 num_fire_offsets++] =
588 buf;
589 have_fire = 1;
22f579c6 590 buf++;
b5e89ed5 591 if (buf < buf_end && *buf == a_fire)
22f579c6
DA		 592 buf++;
593 break;
594 }
b5e89ed5 595 if ((*buf == HALCYON_HEADER2) ||
22f579c6
DA		 596 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
597 DRM_ERROR("Missing Vertex Fire command, "
598 "Stray Vertex Fire command or verifier "
599 "lost sync.\n");
600 ret = 1;
601 break;
602 }
603 if ((ret = eat_words(&buf, buf_end, dw_count)))
604 break;
605 }
606 if (buf >= buf_end && !have_fire) {
607 DRM_ERROR("Missing Vertex Fire command or verifier "
608 "lost sync.\n");
609 ret = 1;
610 break;
611 }
612 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
613 DRM_ERROR("AGP Primitive list end misaligned.\n");
614 ret = 1;
615 break;
616 }
b5e89ed5 617 }
22f579c6
DA		 618 *buffer = buf;
619 return ret;
620}
621
22f579c6 622static __inline__ verifier_state_t
58c1e85a
NK		 623via_check_header2(uint32_t const **buffer, const uint32_t *buf_end,
624 drm_via_state_t *hc_state)
22f579c6
DA		 625{
626 uint32_t cmd;
627 int hz_mode;
628 hazard_t hz;
629 const uint32_t *buf = *buffer;
630 const hazard_t *hz_table;
631
22f579c6 632 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 633 DRM_ERROR
634 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
22f579c6
DA		 635 return state_error;
636 }
637 buf++;
638 cmd = (*buf++ & 0xFFFF0000) >> 16;
639
b5e89ed5 640 switch (cmd) {
22f579c6 641 case HC_ParaType_CmdVdata:
b5e89ed5 642 if (via_check_prim_list(&buf, buf_end, hc_state))
22f579c6
DA		 643 return state_error;
644 *buffer = buf;
645 return state_command;
646 case HC_ParaType_NotTex:
647 hz_table = table1;
648 break;
649 case HC_ParaType_Tex:
650 hc_state->texture = 0;
651 hz_table = table2;
652 break;
653 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
654 hc_state->texture = 1;
655 hz_table = table2;
656 break;
657 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
658 hz_table = table3;
659 break;
660 case HC_ParaType_Auto:
661 if (eat_words(&buf, buf_end, 2))
662 return state_error;
663 *buffer = buf;
664 return state_command;
665 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
666 if (eat_words(&buf, buf_end, 32))
667 return state_error;
668 *buffer = buf;
669 return state_command;
670 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
671 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
672 DRM_ERROR("Texture palettes are rejected because of "
673 "lack of info how to determine their size.\n");
674 return state_error;
675 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
676 DRM_ERROR("Fog factor palettes are rejected because of "
677 "lack of info how to determine their size.\n");
678 return state_error;
679 default:
680
681 /*
682 * There are some unimplemented HC_ParaTypes here, that
683 * need to be implemented if the Mesa driver is extended.
684 */
685
686 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
b5e89ed5
DA		 687 "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
688 cmd, *(buf - 2));
22f579c6
DA		 689 *buffer = buf;
690 return state_error;
691 }
692
b5e89ed5 693 while (buf < buf_end) {
22f579c6
DA		 694 cmd = *buf++;
695 if ((hz = hz_table[cmd >> 24])) {
696 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
697 if (hz_mode == 1) {
698 buf--;
699 break;
700 }
701 return state_error;
702 }
b5e89ed5 703 } else if (hc_state->unfinished &&
22f579c6
DA		 704 finish_current_sequence(hc_state)) {
705 return state_error;
706 }
707 }
58c1e85a 708 if (hc_state->unfinished && finish_current_sequence(hc_state))
22f579c6 709 return state_error;
22f579c6
DA		 710 *buffer = buf;
711 return state_command;
712}
713
714static __inline__ verifier_state_t
58c1e85a
NK		 715via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer,
716 const uint32_t *buf_end, int *fire_count)
22f579c6
DA		 717{
718 uint32_t cmd;
719 const uint32_t *buf = *buffer;
b5e89ed5 720 const uint32_t *next_fire;
22f579c6
DA		 721 int burst = 0;
722
723 next_fire = dev_priv->fire_offsets[*fire_count];
724 buf++;
725 cmd = (*buf & 0xFFFF0000) >> 16;
726 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
b5e89ed5 727 switch (cmd) {
22f579c6
DA		 728 case HC_ParaType_CmdVdata:
729 while ((buf < buf_end) &&
b5e89ed5
DA		 730 (*fire_count < dev_priv->num_fire_offsets) &&
731 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
732 while (buf <= next_fire) {
733 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
734 (burst & 63), *buf++);
22f579c6
DA		 735 burst += 4;
736 }
b5e89ed5
DA		 737 if ((buf < buf_end)
738 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
22f579c6
DA		 739 buf++;
740
b5e89ed5 741 if (++(*fire_count) < dev_priv->num_fire_offsets)
22f579c6
DA		 742 next_fire = dev_priv->fire_offsets[*fire_count];
743 }
744 break;
745 default:
b5e89ed5
DA		 746 while (buf < buf_end) {
747
748 if (*buf == HC_HEADER2 ||
749 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
750 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
751 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
752 break;
753
754 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
755 (burst & 63), *buf++);
756 burst += 4;
22f579c6
DA		 757 }
758 }
759 *buffer = buf;
760 return state_command;
761}
762
b5e89ed5 763static __inline__ int verify_mmio_address(uint32_t address)
22f579c6 764{
b5e89ed5 765 if ((address > 0x3FF) && (address < 0xC00)) {
22f579c6
DA		 766 DRM_ERROR("Invalid VIDEO DMA command. "
767 "Attempt to access 3D- or command burst area.\n");
768 return 1;
769 } else if ((address > 0xCFF) && (address < 0x1300)) {
770 DRM_ERROR("Invalid VIDEO DMA command. "
771 "Attempt to access PCI DMA area.\n");
b5e89ed5
DA		 772 return 1;
773 } else if (address > 0x13FF) {
22f579c6
DA		 774 DRM_ERROR("Invalid VIDEO DMA command. "
775 "Attempt to access VGA registers.\n");
776 return 1;
777 }
778 return 0;
779}
780
781static __inline__ int
b5e89ed5
DA		 782verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
783 uint32_t dwords)
22f579c6
DA		 784{
785 const uint32_t *buf = *buffer;
786
787 if (buf_end - buf < dwords) {
788 DRM_ERROR("Illegal termination of video command.\n");
789 return 1;
790 }
791 while (dwords--) {
792 if (*buf++) {
793 DRM_ERROR("Illegal video command tail.\n");
794 return 1;
795 }
796 }
797 *buffer = buf;
798 return 0;
799}
22f579c6
DA		 800
801static __inline__ verifier_state_t
b5e89ed5 802via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 803{
804 uint32_t cmd;
805 const uint32_t *buf = *buffer;
806 verifier_state_t ret = state_command;
807
808 while (buf < buf_end) {
809 cmd = *buf;
810 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
b5e89ed5
DA		 811 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
812 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 813 break;
814 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
815 "Attempt to access 3D- or command burst area.\n");
816 ret = state_error;
817 break;
818 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
b5e89ed5 819 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 820 break;
821 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
822 "Attempt to access VGA registers.\n");
823 ret = state_error;
b5e89ed5
DA		 824 break;
825 } else {
22f579c6
DA		 826 buf += 2;
827 }
828 }
829 *buffer = buf;
830 return ret;
831}
832
833static __inline__ verifier_state_t
58c1e85a
NK		 834via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer,
835 const uint32_t *buf_end)
22f579c6
DA		 836{
837 register uint32_t cmd;
838 const uint32_t *buf = *buffer;
839
840 while (buf < buf_end) {
841 cmd = *buf;
b5e89ed5
DA		 842 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
843 break;
844 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
22f579c6
DA		 845 buf++;
846 }
847 *buffer = buf;
848 return state_command;
849}
850
851static __inline__ verifier_state_t
58c1e85a 852via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end)
22f579c6
DA		 853{
854 uint32_t data;
855 const uint32_t *buf = *buffer;
856
857 if (buf_end - buf < 4) {
858 DRM_ERROR("Illegal termination of video header5 command\n");
859 return state_error;
860 }
861
862 data = *buf++ & ~VIA_VIDEOMASK;
863 if (verify_mmio_address(data))
864 return state_error;
865
866 data = *buf++;
867 if (*buf++ != 0x00F50000) {
868 DRM_ERROR("Illegal header5 header data\n");
869 return state_error;
870 }
871 if (*buf++ != 0x00000000) {
872 DRM_ERROR("Illegal header5 header data\n");
873 return state_error;
874 }
b5e89ed5 875 if (eat_words(&buf, buf_end, data))
22f579c6 876 return state_error;
b5e89ed5 877 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
22f579c6
DA		 878 return state_error;
879 *buffer = buf;
880 return state_command;
b5e89ed5
DA		 881
882}
22f579c6
DA		 883
884static __inline__ verifier_state_t
58c1e85a
NK		 885via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer,
886 const uint32_t *buf_end)
22f579c6 887{
b5e89ed5 888 uint32_t addr, count, i;
22f579c6 889 const uint32_t *buf = *buffer;
b5e89ed5 890
22f579c6
DA		 891 addr = *buf++ & ~VIA_VIDEOMASK;
892 i = count = *buf;
893 buf += 3;
58c1e85a 894 while (i--)
22f579c6 895 VIA_WRITE(addr, *buf++);
b5e89ed5
DA		 896 if (count & 3)
897 buf += 4 - (count & 3);
22f579c6 898 *buffer = buf;
b5e89ed5
DA		 899 return state_command;
900}
22f579c6
DA		 901
902static __inline__ verifier_state_t
b5e89ed5 903via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 904{
905 uint32_t data;
906 const uint32_t *buf = *buffer;
907 uint32_t i;
908
22f579c6
DA		 909 if (buf_end - buf < 4) {
910 DRM_ERROR("Illegal termination of video header6 command\n");
911 return state_error;
912 }
913 buf++;
914 data = *buf++;
915 if (*buf++ != 0x00F60000) {
916 DRM_ERROR("Illegal header6 header data\n");
917 return state_error;
918 }
919 if (*buf++ != 0x00000000) {
920 DRM_ERROR("Illegal header6 header data\n");
921 return state_error;
922 }
923 if ((buf_end - buf) < (data << 1)) {
924 DRM_ERROR("Illegal termination of video header6 command\n");
925 return state_error;
926 }
b5e89ed5 927 for (i = 0; i < data; ++i) {
22f579c6
DA		 928 if (verify_mmio_address(*buf++))
929 return state_error;
930 buf++;
931 }
932 data <<= 1;
933 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
934 return state_error;
935 *buffer = buf;
936 return state_command;
b5e89ed5 937}
22f579c6
DA		 938
939static __inline__ verifier_state_t
58c1e85a
NK		 940via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer,
941 const uint32_t *buf_end)
22f579c6
DA		 942{
943
b5e89ed5 944 uint32_t addr, count, i;
22f579c6
DA		 945 const uint32_t *buf = *buffer;
946
947 i = count = *++buf;
948 buf += 3;
b5e89ed5 949 while (i--) {
22f579c6
DA		 950 addr = *buf++;
951 VIA_WRITE(addr, *buf++);
952 }
953 count <<= 1;
b5e89ed5
DA		 954 if (count & 3)
955 buf += 4 - (count & 3);
22f579c6
DA		 956 *buffer = buf;
957 return state_command;
b5e89ed5 958}
22f579c6 959
b5e89ed5
DA		 960int
961via_verify_command_stream(const uint32_t * buf, unsigned int size,
84b1fd10 962 struct drm_device * dev, int agp)
22f579c6
DA		 963{
964
965 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
966 drm_via_state_t *hc_state = &dev_priv->hc_state;
967 drm_via_state_t saved_state = *hc_state;
968 uint32_t cmd;
b5e89ed5 969 const uint32_t *buf_end = buf + (size >> 2);
22f579c6 970 verifier_state_t state = state_command;
689692e7
TH		 971 int cme_video;
972 int supported_3d;
973
974 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
975 dev_priv->chipset == VIA_DX9_0);
976
977 supported_3d = dev_priv->chipset != VIA_DX9_0;
b5e89ed5 978
22f579c6
DA		 979 hc_state->dev = dev;
980 hc_state->unfinished = no_sequence;
981 hc_state->map_cache = NULL;
982 hc_state->agp = agp;
983 hc_state->buf_start = buf;
984 dev_priv->num_fire_offsets = 0;
985
986 while (buf < buf_end) {
987
988 switch (state) {
989 case state_header2:
b5e89ed5 990 state = via_check_header2(&buf, buf_end, hc_state);
22f579c6
DA		 991 break;
992 case state_header1:
b5e89ed5 993 state = via_check_header1(&buf, buf_end);
22f579c6
DA		 994 break;
995 case state_vheader5:
b5e89ed5 996 state = via_check_vheader5(&buf, buf_end);
22f579c6
DA		 997 break;
998 case state_vheader6:
b5e89ed5 999 state = via_check_vheader6(&buf, buf_end);
22f579c6
DA		 1000 break;
1001 case state_command:
689692e7
TH		 1002 if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1003 supported_3d)
22f579c6 1004 state = state_header2;
b5e89ed5 1005 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6 1006 state = state_header1;
689692e7 1007 else if (cme_video
b5e89ed5 1008 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
22f579c6 1009 state = state_vheader5;
689692e7 1010 else if (cme_video
b5e89ed5 1011 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
22f579c6 1012 state = state_vheader6;
689692e7
TH		 1013 else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1014 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1015 state = state_error;
1016 } else {
b5e89ed5
DA		 1017 DRM_ERROR
1018 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1019 cmd);
22f579c6
DA		 1020 state = state_error;
1021 }
1022 break;
1023 case state_error:
1024 default:
1025 *hc_state = saved_state;
20caafa6 1026 return -EINVAL;
22f579c6 1027 }
b5e89ed5 1028 }
22f579c6
DA		 1029 if (state == state_error) {
1030 *hc_state = saved_state;
20caafa6 1031 return -EINVAL;
22f579c6
DA		 1032 }
1033 return 0;
1034}
1035
b5e89ed5 1036int
58c1e85a 1037via_parse_command_stream(struct drm_device *dev, const uint32_t *buf,
b5e89ed5 1038 unsigned int size)
22f579c6
DA		 1039{
1040
1041 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1042 uint32_t cmd;
b5e89ed5 1043 const uint32_t *buf_end = buf + (size >> 2);
22f579c6
DA		 1044 verifier_state_t state = state_command;
1045 int fire_count = 0;
b5e89ed5 1046
22f579c6
DA		 1047 while (buf < buf_end) {
1048
1049 switch (state) {
1050 case state_header2:
b5e89ed5
DA		 1051 state =
1052 via_parse_header2(dev_priv, &buf, buf_end,
1053 &fire_count);
22f579c6
DA		 1054 break;
1055 case state_header1:
b5e89ed5 1056 state = via_parse_header1(dev_priv, &buf, buf_end);
22f579c6
DA		 1057 break;
1058 case state_vheader5:
b5e89ed5 1059 state = via_parse_vheader5(dev_priv, &buf, buf_end);
22f579c6
DA		 1060 break;
1061 case state_vheader6:
b5e89ed5 1062 state = via_parse_vheader6(dev_priv, &buf, buf_end);
22f579c6
DA		 1063 break;
1064 case state_command:
b5e89ed5 1065 if (HALCYON_HEADER2 == (cmd = *buf))
22f579c6 1066 state = state_header2;
b5e89ed5 1067 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6
DA		 1068 state = state_header1;
1069 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1070 state = state_vheader5;
1071 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1072 state = state_vheader6;
1073 else {
b5e89ed5
DA		 1074 DRM_ERROR
1075 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1076 cmd);
22f579c6
DA		 1077 state = state_error;
1078 }
1079 break;
1080 case state_error:
1081 default:
20caafa6 1082 return -EINVAL;
22f579c6 1083 }
b5e89ed5 1084 }
58c1e85a 1085 if (state == state_error)
20caafa6 1086 return -EINVAL;
22f579c6
DA		 1087 return 0;
1088}
1089
b5e89ed5 1090static void
22f579c6
DA		 1091setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1092{
1093 int i;
1094
58c1e85a 1095 for (i = 0; i < 256; ++i)
22f579c6 1096 table[i] = forbidden_command;
22f579c6 1097
58c1e85a 1098 for (i = 0; i < size; ++i)
22f579c6 1099 table[init_table[i].code] = init_table[i].hz;
22f579c6
DA		 1100}
1101
b5e89ed5 1102void via_init_command_verifier(void)
22f579c6 1103{
b5e89ed5
DA		 1104 setup_hazard_table(init_table1, table1,
1105 sizeof(init_table1) / sizeof(hz_init_t));
1106 setup_hazard_table(init_table2, table2,
1107 sizeof(init_table2) / sizeof(hz_init_t));
1108 setup_hazard_table(init_table3, table3,
1109 sizeof(init_table3) / sizeof(hz_init_t));
22f579c6 1110}
ubuntu-bionic-kernel mirror