]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/gpu/drm/via/via_verifier.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
UBUNTU: Ubuntu-4.15.0-96.97
[mirror_ubuntu-bionic-kernel.git] / drivers / gpu / drm / via / via_verifier.c
CommitLineData
22f579c6
DA		 1/*
2 * Copyright 2004 The Unichrome Project. All Rights Reserved.
3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sub license,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial portions
14 * of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 * DEALINGS IN THE SOFTWARE.
23 *
24 * Author: Thomas Hellstrom 2004, 2005.
25 * This code was written using docs obtained under NDA from VIA Inc.
26 *
27 * Don't run this code directly on an AGP buffer. Due to cache problems it will
28 * be very slow.
29 */
30
22f579c6 31#include "via_3d_reg.h"
760285e7
DH		 32#include <drm/drmP.h>
33#include <drm/via_drm.h>
ba8286fa 34#include <drm/drm_legacy.h>
22f579c6
DA		 35#include "via_verifier.h"
36#include "via_drv.h"
2e20c9dd 37#include <linux/kernel.h>
22f579c6 38
b5e89ed5 39typedef enum {
22f579c6
DA		 40 state_command,
41 state_header2,
42 state_header1,
43 state_vheader5,
44 state_vheader6,
45 state_error
46} verifier_state_t;
47
b5e89ed5 48typedef enum {
22f579c6
DA		 49 no_check = 0,
50 check_for_header2,
51 check_for_header1,
52 check_for_header2_err,
53 check_for_header1_err,
54 check_for_fire,
55 check_z_buffer_addr0,
56 check_z_buffer_addr1,
57 check_z_buffer_addr_mode,
58 check_destination_addr0,
59 check_destination_addr1,
60 check_destination_addr_mode,
61 check_for_dummy,
62 check_for_dd,
63 check_texture_addr0,
64 check_texture_addr1,
65 check_texture_addr2,
66 check_texture_addr3,
67 check_texture_addr4,
68 check_texture_addr5,
69 check_texture_addr6,
70 check_texture_addr7,
71 check_texture_addr8,
72 check_texture_addr_mode,
73 check_for_vertex_count,
74 check_number_texunits,
75 forbidden_command
b5e89ed5 76} hazard_t;
22f579c6
DA		 77
78/*
79 * Associates each hazard above with a possible multi-command
80 * sequence. For example an address that is split over multiple
b5e89ed5 81 * commands and that needs to be checked at the first command
22f579c6
DA		 82 * that does not include any part of the address.
83 */
84
b5e89ed5 85static drm_via_sequence_t seqs[] = {
22f579c6
DA		 86 no_sequence,
87 no_sequence,
88 no_sequence,
89 no_sequence,
90 no_sequence,
91 no_sequence,
92 z_address,
93 z_address,
94 z_address,
95 dest_address,
96 dest_address,
97 dest_address,
98 no_sequence,
99 no_sequence,
100 tex_address,
101 tex_address,
102 tex_address,
103 tex_address,
104 tex_address,
105 tex_address,
106 tex_address,
107 tex_address,
108 tex_address,
109 tex_address,
110 no_sequence
111};
b5e89ed5
DA		 112
113typedef struct {
22f579c6
DA		 114 unsigned int code;
115 hazard_t hz;
116} hz_init_t;
117
22f579c6
DA		 118static hz_init_t init_table1[] = {
119 {0xf2, check_for_header2_err},
120 {0xf0, check_for_header1_err},
121 {0xee, check_for_fire},
122 {0xcc, check_for_dummy},
123 {0xdd, check_for_dd},
124 {0x00, no_check},
125 {0x10, check_z_buffer_addr0},
126 {0x11, check_z_buffer_addr1},
127 {0x12, check_z_buffer_addr_mode},
128 {0x13, no_check},
129 {0x14, no_check},
130 {0x15, no_check},
131 {0x23, no_check},
132 {0x24, no_check},
133 {0x33, no_check},
134 {0x34, no_check},
135 {0x35, no_check},
136 {0x36, no_check},
137 {0x37, no_check},
138 {0x38, no_check},
139 {0x39, no_check},
140 {0x3A, no_check},
141 {0x3B, no_check},
142 {0x3C, no_check},
143 {0x3D, no_check},
144 {0x3E, no_check},
145 {0x40, check_destination_addr0},
146 {0x41, check_destination_addr1},
147 {0x42, check_destination_addr_mode},
148 {0x43, no_check},
149 {0x44, no_check},
150 {0x50, no_check},
151 {0x51, no_check},
152 {0x52, no_check},
153 {0x53, no_check},
154 {0x54, no_check},
155 {0x55, no_check},
156 {0x56, no_check},
157 {0x57, no_check},
158 {0x58, no_check},
159 {0x70, no_check},
160 {0x71, no_check},
161 {0x78, no_check},
162 {0x79, no_check},
163 {0x7A, no_check},
164 {0x7B, no_check},
165 {0x7C, no_check},
166 {0x7D, check_for_vertex_count}
167};
168
22f579c6
DA		 169static hz_init_t init_table2[] = {
170 {0xf2, check_for_header2_err},
171 {0xf0, check_for_header1_err},
172 {0xee, check_for_fire},
173 {0xcc, check_for_dummy},
174 {0x00, check_texture_addr0},
175 {0x01, check_texture_addr0},
176 {0x02, check_texture_addr0},
177 {0x03, check_texture_addr0},
178 {0x04, check_texture_addr0},
179 {0x05, check_texture_addr0},
180 {0x06, check_texture_addr0},
181 {0x07, check_texture_addr0},
182 {0x08, check_texture_addr0},
183 {0x09, check_texture_addr0},
184 {0x20, check_texture_addr1},
185 {0x21, check_texture_addr1},
186 {0x22, check_texture_addr1},
187 {0x23, check_texture_addr4},
188 {0x2B, check_texture_addr3},
189 {0x2C, check_texture_addr3},
190 {0x2D, check_texture_addr3},
191 {0x2E, check_texture_addr3},
192 {0x2F, check_texture_addr3},
193 {0x30, check_texture_addr3},
194 {0x31, check_texture_addr3},
195 {0x32, check_texture_addr3},
196 {0x33, check_texture_addr3},
197 {0x34, check_texture_addr3},
198 {0x4B, check_texture_addr5},
199 {0x4C, check_texture_addr6},
200 {0x51, check_texture_addr7},
201 {0x52, check_texture_addr8},
202 {0x77, check_texture_addr2},
203 {0x78, no_check},
204 {0x79, no_check},
205 {0x7A, no_check},
206 {0x7B, check_texture_addr_mode},
207 {0x7C, no_check},
208 {0x7D, no_check},
209 {0x7E, no_check},
210 {0x7F, no_check},
211 {0x80, no_check},
212 {0x81, no_check},
213 {0x82, no_check},
214 {0x83, no_check},
215 {0x85, no_check},
216 {0x86, no_check},
217 {0x87, no_check},
218 {0x88, no_check},
219 {0x89, no_check},
220 {0x8A, no_check},
221 {0x90, no_check},
222 {0x91, no_check},
223 {0x92, no_check},
224 {0x93, no_check}
225};
226
227static hz_init_t init_table3[] = {
228 {0xf2, check_for_header2_err},
229 {0xf0, check_for_header1_err},
230 {0xcc, check_for_dummy},
231 {0x00, check_number_texunits}
232};
22f579c6 233
b5e89ed5
DA		 234static hazard_t table1[256];
235static hazard_t table2[256];
236static hazard_t table3[256];
22f579c6
DA		 237
238static __inline__ int
58c1e85a 239eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
22f579c6 240{
92514243 241 if ((buf_end - *buf) >= num_words) {
22f579c6
DA		 242 *buf += num_words;
243 return 0;
b5e89ed5 244 }
22f579c6
DA		 245 DRM_ERROR("Illegal termination of DMA command buffer\n");
246 return 1;
247}
248
22f579c6
DA		 249/*
250 * Partially stolen from drm_memory.h
251 */
252
92514243 253static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
b5e89ed5
DA		 254 unsigned long offset,
255 unsigned long size,
58c1e85a 256 struct drm_device *dev)
22f579c6 257{
55910517 258 struct drm_map_list *r_list;
92514243 259 drm_local_map_t *map = seq->map_cache;
22f579c6 260
b5e89ed5
DA		 261 if (map && map->offset <= offset
262 && (offset + size) <= (map->offset + map->size)) {
22f579c6
DA		 263 return map;
264 }
b5e89ed5 265
bd1b331f 266 list_for_each_entry(r_list, &dev->maplist, head) {
22f579c6
DA		 267 map = r_list->map;
268 if (!map)
269 continue;
b5e89ed5
DA		 270 if (map->offset <= offset
271 && (offset + size) <= (map->offset + map->size)
272 && !(map->flags & _DRM_RESTRICTED)
273 && (map->type == _DRM_AGP)) {
22f579c6
DA		 274 seq->map_cache = map;
275 return map;
276 }
277 }
278 return NULL;
279}
280
22f579c6 281/*
b5e89ed5 282 * Require that all AGP texture levels reside in the same AGP map which should
22f579c6 283 * be mappable by the client. This is not a big restriction.
b5e89ed5
DA		 284 * FIXME: To actually enforce this security policy strictly, drm_rmmap
285 * would have to wait for dma quiescent before removing an AGP map.
22f579c6
DA		 286 * The via_drm_lookup_agp_map call in reality seems to take
287 * very little CPU time.
288 */
289
b5e89ed5 290static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
22f579c6 291{
b5e89ed5 292 switch (cur_seq->unfinished) {
22f579c6
DA		 293 case z_address:
294 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
295 break;
296 case dest_address:
b5e89ed5
DA		 297 DRM_DEBUG("Destination start address is 0x%x\n",
298 cur_seq->d_addr);
22f579c6
DA		 299 break;
300 case tex_address:
b5e89ed5
DA		 301 if (cur_seq->agp_texture) {
302 unsigned start =
303 cur_seq->tex_level_lo[cur_seq->texture];
22f579c6 304 unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
b5e89ed5 305 unsigned long lo = ~0, hi = 0, tmp;
22f579c6
DA		 306 uint32_t *addr, *pitch, *height, tex;
307 unsigned i;
9b8d9d0e 308 int npot;
22f579c6 309
b5e89ed5
DA		 310 if (end > 9)
311 end = 9;
312 if (start > 9)
313 start = 9;
22f579c6 314
b5e89ed5
DA		 315 addr =
316 &(cur_seq->t_addr[tex = cur_seq->texture][start]);
22f579c6
DA		 317 pitch = &(cur_seq->pitch[tex][start]);
318 height = &(cur_seq->height[tex][start]);
9b8d9d0e 319 npot = cur_seq->tex_npot[tex];
b5e89ed5 320 for (i = start; i <= end; ++i) {
22f579c6 321 tmp = *addr++;
b5e89ed5
DA		 322 if (tmp < lo)
323 lo = tmp;
9b8d9d0e
TH		 324 if (i == 0 && npot)
325 tmp += (*height++ * *pitch++);
326 else
327 tmp += (*height++ << *pitch++);
b5e89ed5
DA		 328 if (tmp > hi)
329 hi = tmp;
22f579c6
DA		 330 }
331
b5e89ed5
DA		 332 if (!via_drm_lookup_agp_map
333 (cur_seq, lo, hi - lo, cur_seq->dev)) {
334 DRM_ERROR
335 ("AGP texture is not in allowed map\n");
22f579c6
DA		 336 return 2;
337 }
b5e89ed5 338 }
22f579c6
DA		 339 break;
340 default:
341 break;
342 }
343 cur_seq->unfinished = no_sequence;
344 return 0;
345}
346
b5e89ed5 347static __inline__ int
58c1e85a 348investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
22f579c6
DA		 349{
350 register uint32_t tmp, *tmp_addr;
351
352 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
353 int ret;
b5e89ed5
DA		 354 if ((ret = finish_current_sequence(cur_seq)))
355 return ret;
22f579c6
DA		 356 }
357
b5e89ed5 358 switch (hz) {
22f579c6 359 case check_for_header2:
b5e89ed5
DA		 360 if (cmd == HALCYON_HEADER2)
361 return 1;
22f579c6
DA		 362 return 0;
363 case check_for_header1:
b5e89ed5
DA		 364 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
365 return 1;
22f579c6
DA		 366 return 0;
367 case check_for_header2_err:
b5e89ed5
DA		 368 if (cmd == HALCYON_HEADER2)
369 return 1;
22f579c6
DA		 370 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
371 break;
372 case check_for_header1_err:
b5e89ed5
DA		 373 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
374 return 1;
22f579c6
DA		 375 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
376 break;
377 case check_for_fire:
b5e89ed5
DA		 378 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
379 return 1;
22f579c6
DA		 380 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
381 break;
382 case check_for_dummy:
b5e89ed5
DA		 383 if (HC_DUMMY == cmd)
384 return 0;
22f579c6
DA		 385 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
386 break;
387 case check_for_dd:
b5e89ed5
DA		 388 if (0xdddddddd == cmd)
389 return 0;
22f579c6
DA		 390 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
391 break;
392 case check_z_buffer_addr0:
393 cur_seq->unfinished = z_address;
394 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
b5e89ed5 395 (cmd & 0x00FFFFFF);
22f579c6
DA		 396 return 0;
397 case check_z_buffer_addr1:
398 cur_seq->unfinished = z_address;
399 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
b5e89ed5 400 ((cmd & 0xFF) << 24);
22f579c6
DA		 401 return 0;
402 case check_z_buffer_addr_mode:
403 cur_seq->unfinished = z_address;
b5e89ed5
DA		 404 if ((cmd & 0x0000C000) == 0)
405 return 0;
22f579c6
DA		 406 DRM_ERROR("Attempt to place Z buffer in system memory\n");
407 return 2;
408 case check_destination_addr0:
409 cur_seq->unfinished = dest_address;
410 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
b5e89ed5 411 (cmd & 0x00FFFFFF);
22f579c6
DA		 412 return 0;
413 case check_destination_addr1:
414 cur_seq->unfinished = dest_address;
415 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
b5e89ed5 416 ((cmd & 0xFF) << 24);
22f579c6
DA		 417 return 0;
418 case check_destination_addr_mode:
419 cur_seq->unfinished = dest_address;
b5e89ed5
DA		 420 if ((cmd & 0x0000C000) == 0)
421 return 0;
422 DRM_ERROR
423 ("Attempt to place 3D drawing buffer in system memory\n");
424 return 2;
22f579c6
DA		 425 case check_texture_addr0:
426 cur_seq->unfinished = tex_address;
427 tmp = (cmd >> 24);
428 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
429 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
430 return 0;
431 case check_texture_addr1:
432 cur_seq->unfinished = tex_address;
433 tmp = ((cmd >> 24) - 0x20);
434 tmp += tmp << 1;
435 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
436 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
437 tmp_addr++;
438 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
439 tmp_addr++;
440 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
441 return 0;
442 case check_texture_addr2:
443 cur_seq->unfinished = tex_address;
444 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
445 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
446 return 0;
447 case check_texture_addr3:
448 cur_seq->unfinished = tex_address;
9b8d9d0e
TH		 449 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
450 if (tmp == 0 &&
451 (cmd & HC_HTXnEnPit_MASK)) {
452 cur_seq->pitch[cur_seq->texture][tmp] =
453 (cmd & HC_HTXnLnPit_MASK);
454 cur_seq->tex_npot[cur_seq->texture] = 1;
455 } else {
456 cur_seq->pitch[cur_seq->texture][tmp] =
457 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
458 cur_seq->tex_npot[cur_seq->texture] = 0;
459 if (cmd & 0x000FFFFF) {
460 DRM_ERROR
461 ("Unimplemented texture level 0 pitch mode.\n");
462 return 2;
463 }
22f579c6
DA		 464 }
465 return 0;
466 case check_texture_addr4:
467 cur_seq->unfinished = tex_address;
468 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
469 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
470 return 0;
471 case check_texture_addr5:
472 case check_texture_addr6:
473 cur_seq->unfinished = tex_address;
474 /*
475 * Texture width. We don't care since we have the pitch.
b5e89ed5 476 */
22f579c6
DA		 477 return 0;
478 case check_texture_addr7:
479 cur_seq->unfinished = tex_address;
480 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
481 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
482 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
483 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
484 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
485 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
486 tmp_addr[0] = 1 << (cmd & 0x0000000F);
487 return 0;
488 case check_texture_addr8:
489 cur_seq->unfinished = tex_address;
490 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
491 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
b5e89ed5 492 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
22f579c6
DA		 493 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
494 tmp_addr[6] = 1 << (cmd & 0x0000000F);
495 return 0;
496 case check_texture_addr_mode:
497 cur_seq->unfinished = tex_address;
b5e89ed5
DA		 498 if (2 == (tmp = cmd & 0x00000003)) {
499 DRM_ERROR
500 ("Attempt to fetch texture from system memory.\n");
22f579c6
DA		 501 return 2;
502 }
503 cur_seq->agp_texture = (tmp == 3);
b5e89ed5
DA		 504 cur_seq->tex_palette_size[cur_seq->texture] =
505 (cmd >> 16) & 0x000000007;
22f579c6
DA		 506 return 0;
507 case check_for_vertex_count:
508 cur_seq->vertex_count = cmd & 0x0000FFFF;
509 return 0;
510 case check_number_texunits:
b5e89ed5 511 cur_seq->multitex = (cmd >> 3) & 1;
22f579c6
DA		 512 return 0;
513 default:
514 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
515 return 2;
516 }
517 return 2;
518}
519
22f579c6 520static __inline__ int
b5e89ed5 521via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
58c1e85a 522 drm_via_state_t *cur_seq)
22f579c6 523{
b5e89ed5
DA		 524 drm_via_private_t *dev_priv =
525 (drm_via_private_t *) cur_seq->dev->dev_private;
526 uint32_t a_fire, bcmd, dw_count;
22f579c6
DA		 527 int ret = 0;
528 int have_fire;
529 const uint32_t *buf = *buffer;
530
b5e89ed5
DA		 531 while (buf < buf_end) {
532 have_fire = 0;
22f579c6 533 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 534 DRM_ERROR
535 ("Unexpected termination of primitive list.\n");
22f579c6
DA		 536 ret = 1;
537 break;
538 }
b5e89ed5
DA		 539 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
540 break;
22f579c6
DA		 541 bcmd = *buf++;
542 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
543 DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
544 *buf);
545 ret = 1;
546 break;
547 }
b5e89ed5
DA		 548 a_fire =
549 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
550 HC_HE3Fire_MASK;
551
22f579c6
DA		 552 /*
553 * How many dwords per vertex ?
b5e89ed5
DA		 554 */
555
22f579c6
DA		 556 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
557 DRM_ERROR("Illegal B command vertex data for AGP.\n");
558 ret = 1;
559 break;
b5e89ed5 560 }
22f579c6
DA		 561
562 dw_count = 0;
b5e89ed5
DA		 563 if (bcmd & (1 << 7))
564 dw_count += (cur_seq->multitex) ? 2 : 1;
565 if (bcmd & (1 << 8))
566 dw_count += (cur_seq->multitex) ? 2 : 1;
567 if (bcmd & (1 << 9))
568 dw_count++;
569 if (bcmd & (1 << 10))
570 dw_count++;
571 if (bcmd & (1 << 11))
572 dw_count++;
573 if (bcmd & (1 << 12))
574 dw_count++;
575 if (bcmd & (1 << 13))
576 dw_count++;
577 if (bcmd & (1 << 14))
578 dw_count++;
579
580 while (buf < buf_end) {
22f579c6 581 if (*buf == a_fire) {
b5e89ed5
DA		 582 if (dev_priv->num_fire_offsets >=
583 VIA_FIRE_BUF_SIZE) {
22f579c6
DA		 584 DRM_ERROR("Fire offset buffer full.\n");
585 ret = 1;
586 break;
587 }
b5e89ed5
DA		 588 dev_priv->fire_offsets[dev_priv->
589 num_fire_offsets++] =
590 buf;
591 have_fire = 1;
22f579c6 592 buf++;
b5e89ed5 593 if (buf < buf_end && *buf == a_fire)
22f579c6
DA		 594 buf++;
595 break;
596 }
b5e89ed5 597 if ((*buf == HALCYON_HEADER2) ||
22f579c6
DA		 598 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
599 DRM_ERROR("Missing Vertex Fire command, "
600 "Stray Vertex Fire command or verifier "
601 "lost sync.\n");
602 ret = 1;
603 break;
604 }
605 if ((ret = eat_words(&buf, buf_end, dw_count)))
606 break;
607 }
608 if (buf >= buf_end && !have_fire) {
609 DRM_ERROR("Missing Vertex Fire command or verifier "
610 "lost sync.\n");
611 ret = 1;
612 break;
613 }
614 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
615 DRM_ERROR("AGP Primitive list end misaligned.\n");
616 ret = 1;
617 break;
618 }
b5e89ed5 619 }
22f579c6
DA		 620 *buffer = buf;
621 return ret;
622}
623
22f579c6 624static __inline__ verifier_state_t
58c1e85a
NK		 625via_check_header2(uint32_t const **buffer, const uint32_t *buf_end,
626 drm_via_state_t *hc_state)
22f579c6
DA		 627{
628 uint32_t cmd;
629 int hz_mode;
630 hazard_t hz;
631 const uint32_t *buf = *buffer;
632 const hazard_t *hz_table;
633
22f579c6 634 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 635 DRM_ERROR
636 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
22f579c6
DA		 637 return state_error;
638 }
639 buf++;
640 cmd = (*buf++ & 0xFFFF0000) >> 16;
641
b5e89ed5 642 switch (cmd) {
22f579c6 643 case HC_ParaType_CmdVdata:
b5e89ed5 644 if (via_check_prim_list(&buf, buf_end, hc_state))
22f579c6
DA		 645 return state_error;
646 *buffer = buf;
647 return state_command;
648 case HC_ParaType_NotTex:
649 hz_table = table1;
650 break;
651 case HC_ParaType_Tex:
652 hc_state->texture = 0;
653 hz_table = table2;
654 break;
655 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
656 hc_state->texture = 1;
657 hz_table = table2;
658 break;
659 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
660 hz_table = table3;
661 break;
662 case HC_ParaType_Auto:
663 if (eat_words(&buf, buf_end, 2))
664 return state_error;
665 *buffer = buf;
666 return state_command;
667 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
668 if (eat_words(&buf, buf_end, 32))
669 return state_error;
670 *buffer = buf;
671 return state_command;
672 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
673 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
674 DRM_ERROR("Texture palettes are rejected because of "
675 "lack of info how to determine their size.\n");
676 return state_error;
677 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
678 DRM_ERROR("Fog factor palettes are rejected because of "
679 "lack of info how to determine their size.\n");
680 return state_error;
681 default:
682
683 /*
684 * There are some unimplemented HC_ParaTypes here, that
685 * need to be implemented if the Mesa driver is extended.
686 */
687
688 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
b5e89ed5
DA		 689 "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
690 cmd, *(buf - 2));
22f579c6
DA		 691 *buffer = buf;
692 return state_error;
693 }
694
b5e89ed5 695 while (buf < buf_end) {
22f579c6
DA		 696 cmd = *buf++;
697 if ((hz = hz_table[cmd >> 24])) {
698 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
699 if (hz_mode == 1) {
700 buf--;
701 break;
702 }
703 return state_error;
704 }
b5e89ed5 705 } else if (hc_state->unfinished &&
22f579c6
DA		 706 finish_current_sequence(hc_state)) {
707 return state_error;
708 }
709 }
58c1e85a 710 if (hc_state->unfinished && finish_current_sequence(hc_state))
22f579c6 711 return state_error;
22f579c6
DA		 712 *buffer = buf;
713 return state_command;
714}
715
716static __inline__ verifier_state_t
58c1e85a
NK		 717via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer,
718 const uint32_t *buf_end, int *fire_count)
22f579c6
DA		 719{
720 uint32_t cmd;
721 const uint32_t *buf = *buffer;
b5e89ed5 722 const uint32_t *next_fire;
22f579c6
DA		 723 int burst = 0;
724
725 next_fire = dev_priv->fire_offsets[*fire_count];
726 buf++;
727 cmd = (*buf & 0xFFFF0000) >> 16;
728 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
b5e89ed5 729 switch (cmd) {
22f579c6
DA		 730 case HC_ParaType_CmdVdata:
731 while ((buf < buf_end) &&
b5e89ed5
DA		 732 (*fire_count < dev_priv->num_fire_offsets) &&
733 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
734 while (buf <= next_fire) {
735 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
736 (burst & 63), *buf++);
22f579c6
DA		 737 burst += 4;
738 }
b5e89ed5
DA		 739 if ((buf < buf_end)
740 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
22f579c6
DA		 741 buf++;
742
b5e89ed5 743 if (++(*fire_count) < dev_priv->num_fire_offsets)
22f579c6
DA		 744 next_fire = dev_priv->fire_offsets[*fire_count];
745 }
746 break;
747 default:
b5e89ed5
DA		 748 while (buf < buf_end) {
749
750 if (*buf == HC_HEADER2 ||
751 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
752 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
753 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
754 break;
755
756 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
757 (burst & 63), *buf++);
758 burst += 4;
22f579c6
DA		 759 }
760 }
761 *buffer = buf;
762 return state_command;
763}
764
b5e89ed5 765static __inline__ int verify_mmio_address(uint32_t address)
22f579c6 766{
b5e89ed5 767 if ((address > 0x3FF) && (address < 0xC00)) {
22f579c6
DA		 768 DRM_ERROR("Invalid VIDEO DMA command. "
769 "Attempt to access 3D- or command burst area.\n");
770 return 1;
771 } else if ((address > 0xCFF) && (address < 0x1300)) {
772 DRM_ERROR("Invalid VIDEO DMA command. "
773 "Attempt to access PCI DMA area.\n");
b5e89ed5
DA		 774 return 1;
775 } else if (address > 0x13FF) {
22f579c6
DA		 776 DRM_ERROR("Invalid VIDEO DMA command. "
777 "Attempt to access VGA registers.\n");
778 return 1;
779 }
780 return 0;
781}
782
783static __inline__ int
b5e89ed5
DA		 784verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
785 uint32_t dwords)
22f579c6
DA		 786{
787 const uint32_t *buf = *buffer;
788
789 if (buf_end - buf < dwords) {
790 DRM_ERROR("Illegal termination of video command.\n");
791 return 1;
792 }
793 while (dwords--) {
794 if (*buf++) {
795 DRM_ERROR("Illegal video command tail.\n");
796 return 1;
797 }
798 }
799 *buffer = buf;
800 return 0;
801}
22f579c6
DA		 802
803static __inline__ verifier_state_t
b5e89ed5 804via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 805{
806 uint32_t cmd;
807 const uint32_t *buf = *buffer;
808 verifier_state_t ret = state_command;
809
810 while (buf < buf_end) {
811 cmd = *buf;
812 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
b5e89ed5
DA		 813 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
814 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 815 break;
816 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
817 "Attempt to access 3D- or command burst area.\n");
818 ret = state_error;
819 break;
820 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
b5e89ed5 821 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 822 break;
823 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
824 "Attempt to access VGA registers.\n");
825 ret = state_error;
b5e89ed5
DA		 826 break;
827 } else {
22f579c6
DA		 828 buf += 2;
829 }
830 }
831 *buffer = buf;
832 return ret;
833}
834
835static __inline__ verifier_state_t
58c1e85a
NK		 836via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer,
837 const uint32_t *buf_end)
22f579c6
DA		 838{
839 register uint32_t cmd;
840 const uint32_t *buf = *buffer;
841
842 while (buf < buf_end) {
843 cmd = *buf;
b5e89ed5
DA		 844 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
845 break;
846 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
22f579c6
DA		 847 buf++;
848 }
849 *buffer = buf;
850 return state_command;
851}
852
853static __inline__ verifier_state_t
58c1e85a 854via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end)
22f579c6
DA		 855{
856 uint32_t data;
857 const uint32_t *buf = *buffer;
858
859 if (buf_end - buf < 4) {
860 DRM_ERROR("Illegal termination of video header5 command\n");
861 return state_error;
862 }
863
864 data = *buf++ & ~VIA_VIDEOMASK;
865 if (verify_mmio_address(data))
866 return state_error;
867
868 data = *buf++;
869 if (*buf++ != 0x00F50000) {
870 DRM_ERROR("Illegal header5 header data\n");
871 return state_error;
872 }
873 if (*buf++ != 0x00000000) {
874 DRM_ERROR("Illegal header5 header data\n");
875 return state_error;
876 }
b5e89ed5 877 if (eat_words(&buf, buf_end, data))
22f579c6 878 return state_error;
b5e89ed5 879 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
22f579c6
DA		 880 return state_error;
881 *buffer = buf;
882 return state_command;
b5e89ed5
DA		 883
884}
22f579c6
DA		 885
886static __inline__ verifier_state_t
58c1e85a
NK		 887via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer,
888 const uint32_t *buf_end)
22f579c6 889{
b5e89ed5 890 uint32_t addr, count, i;
22f579c6 891 const uint32_t *buf = *buffer;
b5e89ed5 892
22f579c6
DA		 893 addr = *buf++ & ~VIA_VIDEOMASK;
894 i = count = *buf;
895 buf += 3;
58c1e85a 896 while (i--)
22f579c6 897 VIA_WRITE(addr, *buf++);
b5e89ed5
DA		 898 if (count & 3)
899 buf += 4 - (count & 3);
22f579c6 900 *buffer = buf;
b5e89ed5
DA		 901 return state_command;
902}
22f579c6
DA		 903
904static __inline__ verifier_state_t
b5e89ed5 905via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 906{
907 uint32_t data;
908 const uint32_t *buf = *buffer;
909 uint32_t i;
910
22f579c6
DA		 911 if (buf_end - buf < 4) {
912 DRM_ERROR("Illegal termination of video header6 command\n");
913 return state_error;
914 }
915 buf++;
916 data = *buf++;
917 if (*buf++ != 0x00F60000) {
918 DRM_ERROR("Illegal header6 header data\n");
919 return state_error;
920 }
921 if (*buf++ != 0x00000000) {
922 DRM_ERROR("Illegal header6 header data\n");
923 return state_error;
924 }
925 if ((buf_end - buf) < (data << 1)) {
926 DRM_ERROR("Illegal termination of video header6 command\n");
927 return state_error;
928 }
b5e89ed5 929 for (i = 0; i < data; ++i) {
22f579c6
DA		 930 if (verify_mmio_address(*buf++))
931 return state_error;
932 buf++;
933 }
934 data <<= 1;
935 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
936 return state_error;
937 *buffer = buf;
938 return state_command;
b5e89ed5 939}
22f579c6
DA		 940
941static __inline__ verifier_state_t
58c1e85a
NK		 942via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer,
943 const uint32_t *buf_end)
22f579c6
DA		 944{
945
b5e89ed5 946 uint32_t addr, count, i;
22f579c6
DA		 947 const uint32_t *buf = *buffer;
948
949 i = count = *++buf;
950 buf += 3;
b5e89ed5 951 while (i--) {
22f579c6
DA		 952 addr = *buf++;
953 VIA_WRITE(addr, *buf++);
954 }
955 count <<= 1;
b5e89ed5
DA		 956 if (count & 3)
957 buf += 4 - (count & 3);
22f579c6
DA		 958 *buffer = buf;
959 return state_command;
b5e89ed5 960}
22f579c6 961
b5e89ed5
DA		 962int
963via_verify_command_stream(const uint32_t * buf, unsigned int size,
84b1fd10 964 struct drm_device * dev, int agp)
22f579c6
DA		 965{
966
967 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
968 drm_via_state_t *hc_state = &dev_priv->hc_state;
969 drm_via_state_t saved_state = *hc_state;
970 uint32_t cmd;
b5e89ed5 971 const uint32_t *buf_end = buf + (size >> 2);
22f579c6 972 verifier_state_t state = state_command;
689692e7
TH		 973 int cme_video;
974 int supported_3d;
975
976 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
977 dev_priv->chipset == VIA_DX9_0);
978
979 supported_3d = dev_priv->chipset != VIA_DX9_0;
b5e89ed5 980
22f579c6
DA		 981 hc_state->dev = dev;
982 hc_state->unfinished = no_sequence;
983 hc_state->map_cache = NULL;
984 hc_state->agp = agp;
985 hc_state->buf_start = buf;
986 dev_priv->num_fire_offsets = 0;
987
988 while (buf < buf_end) {
989
990 switch (state) {
991 case state_header2:
b5e89ed5 992 state = via_check_header2(&buf, buf_end, hc_state);
22f579c6
DA		 993 break;
994 case state_header1:
b5e89ed5 995 state = via_check_header1(&buf, buf_end);
22f579c6
DA		 996 break;
997 case state_vheader5:
b5e89ed5 998 state = via_check_vheader5(&buf, buf_end);
22f579c6
DA		 999 break;
1000 case state_vheader6:
b5e89ed5 1001 state = via_check_vheader6(&buf, buf_end);
22f579c6
DA		 1002 break;
1003 case state_command:
689692e7
TH		 1004 if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1005 supported_3d)
22f579c6 1006 state = state_header2;
b5e89ed5 1007 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6 1008 state = state_header1;
689692e7 1009 else if (cme_video
b5e89ed5 1010 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
22f579c6 1011 state = state_vheader5;
689692e7 1012 else if (cme_video
b5e89ed5 1013 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
22f579c6 1014 state = state_vheader6;
689692e7
TH		 1015 else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1016 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1017 state = state_error;
1018 } else {
b5e89ed5
DA		 1019 DRM_ERROR
1020 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1021 cmd);
22f579c6
DA		 1022 state = state_error;
1023 }
1024 break;
1025 case state_error:
1026 default:
1027 *hc_state = saved_state;
20caafa6 1028 return -EINVAL;
22f579c6 1029 }
b5e89ed5 1030 }
22f579c6
DA		 1031 if (state == state_error) {
1032 *hc_state = saved_state;
20caafa6 1033 return -EINVAL;
22f579c6
DA		 1034 }
1035 return 0;
1036}
1037
b5e89ed5 1038int
58c1e85a 1039via_parse_command_stream(struct drm_device *dev, const uint32_t *buf,
b5e89ed5 1040 unsigned int size)
22f579c6
DA		 1041{
1042
1043 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1044 uint32_t cmd;
b5e89ed5 1045 const uint32_t *buf_end = buf + (size >> 2);
22f579c6
DA		 1046 verifier_state_t state = state_command;
1047 int fire_count = 0;
b5e89ed5 1048
22f579c6
DA		 1049 while (buf < buf_end) {
1050
1051 switch (state) {
1052 case state_header2:
b5e89ed5
DA		 1053 state =
1054 via_parse_header2(dev_priv, &buf, buf_end,
1055 &fire_count);
22f579c6
DA		 1056 break;
1057 case state_header1:
b5e89ed5 1058 state = via_parse_header1(dev_priv, &buf, buf_end);
22f579c6
DA		 1059 break;
1060 case state_vheader5:
b5e89ed5 1061 state = via_parse_vheader5(dev_priv, &buf, buf_end);
22f579c6
DA		 1062 break;
1063 case state_vheader6:
b5e89ed5 1064 state = via_parse_vheader6(dev_priv, &buf, buf_end);
22f579c6
DA		 1065 break;
1066 case state_command:
b5e89ed5 1067 if (HALCYON_HEADER2 == (cmd = *buf))
22f579c6 1068 state = state_header2;
b5e89ed5 1069 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6
DA		 1070 state = state_header1;
1071 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1072 state = state_vheader5;
1073 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1074 state = state_vheader6;
1075 else {
b5e89ed5
DA		 1076 DRM_ERROR
1077 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1078 cmd);
22f579c6
DA		 1079 state = state_error;
1080 }
1081 break;
1082 case state_error:
1083 default:
20caafa6 1084 return -EINVAL;
22f579c6 1085 }
b5e89ed5 1086 }
58c1e85a 1087 if (state == state_error)
20caafa6 1088 return -EINVAL;
22f579c6
DA		 1089 return 0;
1090}
1091
b5e89ed5 1092static void
22f579c6
DA		 1093setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1094{
1095 int i;
1096
58c1e85a 1097 for (i = 0; i < 256; ++i)
22f579c6 1098 table[i] = forbidden_command;
22f579c6 1099
58c1e85a 1100 for (i = 0; i < size; ++i)
22f579c6 1101 table[init_table[i].code] = init_table[i].hz;
22f579c6
DA		 1102}
1103
b5e89ed5 1104void via_init_command_verifier(void)
22f579c6 1105{
2e20c9dd
JL		 1106 setup_hazard_table(init_table1, table1, ARRAY_SIZE(init_table1));
1107 setup_hazard_table(init_table2, table2, ARRAY_SIZE(init_table2));
1108 setup_hazard_table(init_table3, table3, ARRAY_SIZE(init_table3));
22f579c6 1109}
ubuntu-bionic-kernel mirror