1/* 2 * Copyright 2004 The Unichrome Project. All Rights Reserved. 3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved. 4 * 5 * Permission is hereby granted, free of charge, to any person obtaining a 6 * copy of this software and associated documentation files (the "Software"), 7 * to deal in the Software without restriction, including without limitation 8 * the rights to use, copy, modify, merge, publish, distribute, sub license, 9 * and/or sell copies of the Software, and to permit persons to whom the 10 * Software is furnished to do so, subject to the following conditions: 11 * 12 * The above copyright notice and this permission notice (including the 13 * next paragraph) shall be included in all copies or substantial portions 14 * of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 22 * DEALINGS IN THE SOFTWARE. 23 * 24 * Author: Thomas Hellstrom 2004, 2005. 25 * This code was written using docs obtained under NDA from VIA Inc. 26 * 27 * Don't run this code directly on an AGP buffer. Due to cache problems it will 28 * be very slow. 29 */ 30 31#include "via_3d_reg.h" 32#include "drmP.h" 33#include "drm.h" 34#include "via_drm.h" 35#include "via_verifier.h" 36#include "via_drv.h" 37 38typedef enum { 39 state_command, 40 state_header2, 41 state_header1, 42 state_vheader5, 43 state_vheader6, 44 state_error 45} verifier_state_t; 46 47typedef enum { 48 no_check = 0, 49 check_for_header2, 50 check_for_header1, 51 check_for_header2_err, 52 check_for_header1_err, 53 check_for_fire, 54 check_z_buffer_addr0, 55 check_z_buffer_addr1, 56 check_z_buffer_addr_mode, 57 check_destination_addr0, 58 check_destination_addr1, 59 check_destination_addr_mode, 60 check_for_dummy, 61 check_for_dd, 62 check_texture_addr0, 63 check_texture_addr1, 64 check_texture_addr2, 65 check_texture_addr3, 66 check_texture_addr4, 67 check_texture_addr5, 68 check_texture_addr6, 69 check_texture_addr7, 70 check_texture_addr8, 71 check_texture_addr_mode, 72 check_for_vertex_count, 73 check_number_texunits, 74 forbidden_command 75} hazard_t; 76 77/* 78 * Associates each hazard above with a possible multi-command 79 * sequence. For example an address that is split over multiple 80 * commands and that needs to be checked at the first command 81 * that does not include any part of the address. 82 */ 83 84static drm_via_sequence_t seqs[] = { 85 no_sequence, 86 no_sequence, 87 no_sequence, 88 no_sequence, 89 no_sequence, 90 no_sequence, 91 z_address, 92 z_address, 93 z_address, 94 dest_address, 95 dest_address, 96 dest_address, 97 no_sequence, 98 no_sequence, 99 tex_address, 100 tex_address, 101 tex_address, 102 tex_address, 103 tex_address, 104 tex_address, 105 tex_address, 106 tex_address, 107 tex_address, 108 tex_address, 109 no_sequence 110}; 111 112typedef struct { 113 unsigned int code; 114 hazard_t hz; 115} hz_init_t; 116 117static hz_init_t init_table1[] = { 118 {0xf2, check_for_header2_err}, 119 {0xf0, check_for_header1_err}, 120 {0xee, check_for_fire}, 121 {0xcc, check_for_dummy}, 122 {0xdd, check_for_dd}, 123 {0x00, no_check}, 124 {0x10, check_z_buffer_addr0}, 125 {0x11, check_z_buffer_addr1}, 126 {0x12, check_z_buffer_addr_mode}, 127 {0x13, no_check}, 128 {0x14, no_check}, 129 {0x15, no_check}, 130 {0x23, no_check}, 131 {0x24, no_check}, 132 {0x33, no_check}, 133 {0x34, no_check}, 134 {0x35, no_check}, 135 {0x36, no_check}, 136 {0x37, no_check}, 137 {0x38, no_check}, 138 {0x39, no_check}, 139 {0x3A, no_check}, 140 {0x3B, no_check}, 141 {0x3C, no_check}, 142 {0x3D, no_check}, 143 {0x3E, no_check}, 144 {0x40, check_destination_addr0}, 145 {0x41, check_destination_addr1}, 146 {0x42, check_destination_addr_mode}, 147 {0x43, no_check}, 148 {0x44, no_check}, 149 {0x50, no_check}, 150 {0x51, no_check}, 151 {0x52, no_check}, 152 {0x53, no_check}, 153 {0x54, no_check}, 154 {0x55, no_check}, 155 {0x56, no_check}, 156 {0x57, no_check}, 157 {0x58, no_check}, 158 {0x70, no_check}, 159 {0x71, no_check}, 160 {0x78, no_check}, 161 {0x79, no_check}, 162 {0x7A, no_check}, 163 {0x7B, no_check}, 164 {0x7C, no_check}, 165 {0x7D, check_for_vertex_count} 166}; 167 168static hz_init_t init_table2[] = { 169 {0xf2, check_for_header2_err}, 170 {0xf0, check_for_header1_err}, 171 {0xee, check_for_fire}, 172 {0xcc, check_for_dummy}, 173 {0x00, check_texture_addr0}, 174 {0x01, check_texture_addr0}, 175 {0x02, check_texture_addr0}, 176 {0x03, check_texture_addr0}, 177 {0x04, check_texture_addr0}, 178 {0x05, check_texture_addr0}, 179 {0x06, check_texture_addr0}, 180 {0x07, check_texture_addr0}, 181 {0x08, check_texture_addr0}, 182 {0x09, check_texture_addr0}, 183 {0x20, check_texture_addr1}, 184 {0x21, check_texture_addr1}, 185 {0x22, check_texture_addr1}, 186 {0x23, check_texture_addr4}, 187 {0x2B, check_texture_addr3}, 188 {0x2C, check_texture_addr3}, 189 {0x2D, check_texture_addr3}, 190 {0x2E, check_texture_addr3}, 191 {0x2F, check_texture_addr3}, 192 {0x30, check_texture_addr3}, 193 {0x31, check_texture_addr3}, 194 {0x32, check_texture_addr3}, 195 {0x33, check_texture_addr3}, 196 {0x34, check_texture_addr3}, 197 {0x4B, check_texture_addr5}, 198 {0x4C, check_texture_addr6}, 199 {0x51, check_texture_addr7}, 200 {0x52, check_texture_addr8}, 201 {0x77, check_texture_addr2}, 202 {0x78, no_check}, 203 {0x79, no_check}, 204 {0x7A, no_check}, 205 {0x7B, check_texture_addr_mode}, 206 {0x7C, no_check}, 207 {0x7D, no_check}, 208 {0x7E, no_check}, 209 {0x7F, no_check}, 210 {0x80, no_check}, 211 {0x81, no_check}, 212 {0x82, no_check}, 213 {0x83, no_check}, 214 {0x85, no_check}, 215 {0x86, no_check}, 216 {0x87, no_check}, 217 {0x88, no_check}, 218 {0x89, no_check}, 219 {0x8A, no_check}, 220 {0x90, no_check}, 221 {0x91, no_check}, 222 {0x92, no_check}, 223 {0x93, no_check} 224}; 225 226static hz_init_t init_table3[] = { 227 {0xf2, check_for_header2_err}, 228 {0xf0, check_for_header1_err}, 229 {0xcc, check_for_dummy}, 230 {0x00, check_number_texunits} 231}; 232 233static hazard_t table1[256]; 234static hazard_t table2[256]; 235static hazard_t table3[256]; 236 237static __inline__ int 238eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words) 239{ 240 if ((buf_end - *buf) >= num_words) { 241 *buf += num_words; 242 return 0; 243 } 244 DRM_ERROR("Illegal termination of DMA command buffer\n"); 245 return 1; 246} 247 248/* 249 * Partially stolen from drm_memory.h 250 */ 251 252static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq, 253 unsigned long offset, 254 unsigned long size, 255 struct drm_device *dev) 256{ 257 struct drm_map_list *r_list; 258 drm_local_map_t *map = seq->map_cache; 259 260 if (map && map->offset <= offset 261 && (offset + size) <= (map->offset + map->size)) { 262 return map; 263 } 264 265 list_for_each_entry(r_list, &dev->maplist, head) { 266 map = r_list->map; 267 if (!map) 268 continue; 269 if (map->offset <= offset 270 && (offset + size) <= (map->offset + map->size) 271 && !(map->flags & _DRM_RESTRICTED) 272 && (map->type == _DRM_AGP)) { 273 seq->map_cache = map; 274 return map; 275 } 276 } 277 return NULL; 278} 279 280 281static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq) 282{ 283 switch (cur_seq->unfinished) { 284 case z_address: 285 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr); 286 break; 287 case dest_address: 288 DRM_DEBUG("Destination start address is 0x%x\n", 289 cur_seq->d_addr); 290 break; 291 case tex_address: 292 if (cur_seq->agp_texture) { 293 unsigned start = 294 cur_seq->tex_level_lo[cur_seq->texture]; 295 unsigned end = cur_seq->tex_level_hi[cur_seq->texture]; 296 unsigned long lo = ~0, hi = 0, tmp; 297 uint32_t *addr, *pitch, *height, tex; 298 unsigned i; 299 int npot; 300 301 if (end > 9) 302 end = 9; 303 if (start > 9) 304 start = 9; 305 306 addr = 307 &(cur_seq->t_addr[tex = cur_seq->texture][start]); 308 pitch = &(cur_seq->pitch[tex][start]); 309 height = &(cur_seq->height[tex][start]); 310 npot = cur_seq->tex_npot[tex]; 311 for (i = start; i <= end; ++i) { 312 tmp = *addr++; 313 if (tmp < lo) 314 lo = tmp; 315 if (i == 0 && npot) 316 tmp += (*height++ * *pitch++); 317 else 318 tmp += (*height++ << *pitch++); 319 if (tmp > hi) 320 hi = tmp; 321 } 322 323 if (!via_drm_lookup_agp_map 324 (cur_seq, lo, hi - lo, cur_seq->dev)) { 325 DRM_ERROR 326 ("AGP texture is not in allowed map\n"); 327 return 2; 328 } 329 } 330 break; 331 default: 332 break; 333 } 334 cur_seq->unfinished = no_sequence; 335 return 0; 336} 337 338static __inline__ int 339investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq) 340{ 341 register uint32_t tmp, *tmp_addr; 342 343 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) { 344 int ret; 345 if ((ret = finish_current_sequence(cur_seq))) 346 return ret; 347 } 348 349 switch (hz) { 350 case check_for_header2: 351 if (cmd == HALCYON_HEADER2) 352 return 1; 353 return 0; 354 case check_for_header1: 355 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 356 return 1; 357 return 0; 358 case check_for_header2_err: 359 if (cmd == HALCYON_HEADER2) 360 return 1; 361 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n"); 362 break; 363 case check_for_header1_err: 364 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 365 return 1; 366 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n"); 367 break; 368 case check_for_fire: 369 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD) 370 return 1; 371 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n"); 372 break; 373 case check_for_dummy: 374 if (HC_DUMMY == cmd) 375 return 0; 376 DRM_ERROR("Illegal DMA HC_DUMMY command\n"); 377 break; 378 case check_for_dd: 379 if (0xdddddddd == cmd) 380 return 0; 381 DRM_ERROR("Illegal DMA 0xdddddddd command\n"); 382 break; 383 case check_z_buffer_addr0: 384 cur_seq->unfinished = z_address; 385 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) | 386 (cmd & 0x00FFFFFF); 387 return 0; 388 case check_z_buffer_addr1: 389 cur_seq->unfinished = z_address; 390 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) | 391 ((cmd & 0xFF) << 24); 392 return 0; 393 case check_z_buffer_addr_mode: 394 cur_seq->unfinished = z_address; 395 if ((cmd & 0x0000C000) == 0) 396 return 0; 397 DRM_ERROR("Attempt to place Z buffer in system memory\n"); 398 return 2; 399 case check_destination_addr0: 400 cur_seq->unfinished = dest_address; 401 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) | 402 (cmd & 0x00FFFFFF); 403 return 0; 404 case check_destination_addr1: 405 cur_seq->unfinished = dest_address; 406 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) | 407 ((cmd & 0xFF) << 24); 408 return 0; 409 case check_destination_addr_mode: 410 cur_seq->unfinished = dest_address; 411 if ((cmd & 0x0000C000) == 0) 412 return 0; 413 DRM_ERROR 414 ("Attempt to place 3D drawing buffer in system memory\n"); 415 return 2; 416 case check_texture_addr0: 417 cur_seq->unfinished = tex_address; 418 tmp = (cmd >> 24); 419 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 420 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF); 421 return 0; 422 case check_texture_addr1: 423 cur_seq->unfinished = tex_address; 424 tmp = ((cmd >> 24) - 0x20); 425 tmp += tmp << 1; 426 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 427 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 428 tmp_addr++; 429 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16); 430 tmp_addr++; 431 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8); 432 return 0; 433 case check_texture_addr2: 434 cur_seq->unfinished = tex_address; 435 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F; 436 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6; 437 return 0; 438 case check_texture_addr3: 439 cur_seq->unfinished = tex_address; 440 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit); 441 if (tmp == 0 && 442 (cmd & HC_HTXnEnPit_MASK)) { 443 cur_seq->pitch[cur_seq->texture][tmp] = 444 (cmd & HC_HTXnLnPit_MASK); 445 cur_seq->tex_npot[cur_seq->texture] = 1; 446 } else { 447 cur_seq->pitch[cur_seq->texture][tmp] = 448 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT; 449 cur_seq->tex_npot[cur_seq->texture] = 0; 450 if (cmd & 0x000FFFFF) { 451 DRM_ERROR 452 ("Unimplemented texture level 0 pitch mode.\n"); 453 return 2; 454 } 455 } 456 return 0; 457 case check_texture_addr4: 458 cur_seq->unfinished = tex_address; 459 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9]; 460 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 461 return 0; 462 case check_texture_addr5: 463 case check_texture_addr6: 464 cur_seq->unfinished = tex_address; 465 /* 466 * Texture width. We don't care since we have the pitch. 467 */ 468 return 0; 469 case check_texture_addr7: 470 cur_seq->unfinished = tex_address; 471 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 472 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20); 473 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16); 474 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12); 475 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8); 476 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4); 477 tmp_addr[0] = 1 << (cmd & 0x0000000F); 478 return 0; 479 case check_texture_addr8: 480 cur_seq->unfinished = tex_address; 481 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 482 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12); 483 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8); 484 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4); 485 tmp_addr[6] = 1 << (cmd & 0x0000000F); 486 return 0; 487 case check_texture_addr_mode: 488 cur_seq->unfinished = tex_address; 489 if (2 == (tmp = cmd & 0x00000003)) { 490 DRM_ERROR 491 ("Attempt to fetch texture from system memory.\n"); 492 return 2; 493 } 494 cur_seq->agp_texture = (tmp == 3); 495 cur_seq->tex_palette_size[cur_seq->texture] = 496 (cmd >> 16) & 0x000000007; 497 return 0; 498 case check_for_vertex_count: 499 cur_seq->vertex_count = cmd & 0x0000FFFF; 500 return 0; 501 case check_number_texunits: 502 cur_seq->multitex = (cmd >> 3) & 1; 503 return 0; 504 default: 505 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd); 506 return 2; 507 } 508 return 2; 509} 510 511static __inline__ int 512via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end, 513 drm_via_state_t *cur_seq) 514{ 515 drm_via_private_t *dev_priv = 516 (drm_via_private_t *) cur_seq->dev->dev_private; 517 uint32_t a_fire, bcmd, dw_count; 518 int ret = 0; 519 int have_fire; 520 const uint32_t *buf = *buffer; 521 522 while (buf < buf_end) { 523 have_fire = 0; 524 if ((buf_end - buf) < 2) { 525 DRM_ERROR 526 ("Unexpected termination of primitive list.\n"); 527 ret = 1; 528 break; 529 } 530 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB) 531 break; 532 bcmd = *buf++; 533 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) { 534 DRM_ERROR("Expected Vertex List A command, got 0x%x\n", 535 *buf); 536 ret = 1; 537 break; 538 } 539 a_fire = 540 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK | 541 HC_HE3Fire_MASK; 542 543 /* 544 * How many dwords per vertex ? 545 */ 546 547 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) { 548 DRM_ERROR("Illegal B command vertex data for AGP.\n"); 549 ret = 1; 550 break; 551 } 552 553 dw_count = 0; 554 if (bcmd & (1 << 7)) 555 dw_count += (cur_seq->multitex) ? 2 : 1; 556 if (bcmd & (1 << 8)) 557 dw_count += (cur_seq->multitex) ? 2 : 1; 558 if (bcmd & (1 << 9)) 559 dw_count++; 560 if (bcmd & (1 << 10)) 561 dw_count++; 562 if (bcmd & (1 << 11)) 563 dw_count++; 564 if (bcmd & (1 << 12)) 565 dw_count++; 566 if (bcmd & (1 << 13)) 567 dw_count++; 568 if (bcmd & (1 << 14)) 569 dw_count++; 570 571 while (buf < buf_end) { 572 if (*buf == a_fire) { 573 if (dev_priv->num_fire_offsets >= 574 VIA_FIRE_BUF_SIZE) { 575 DRM_ERROR("Fire offset buffer full.\n"); 576 ret = 1; 577 break; 578 } 579 dev_priv->fire_offsets[dev_priv-> 580 num_fire_offsets++] = 581 buf; 582 have_fire = 1; 583 buf++; 584 if (buf < buf_end && *buf == a_fire) 585 buf++; 586 break; 587 } 588 if ((*buf == HALCYON_HEADER2) || 589 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) { 590 DRM_ERROR("Missing Vertex Fire command, " 591 "Stray Vertex Fire command or verifier " 592 "lost sync.\n"); 593 ret = 1; 594 break; 595 } 596 if ((ret = eat_words(&buf, buf_end, dw_count))) 597 break; 598 } 599 if (buf >= buf_end && !have_fire) { 600 DRM_ERROR("Missing Vertex Fire command or verifier " 601 "lost sync.\n"); 602 ret = 1; 603 break; 604 } 605 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) { 606 DRM_ERROR("AGP Primitive list end misaligned.\n"); 607 ret = 1; 608 break; 609 } 610 } 611 *buffer = buf; 612 return ret; 613} 614 615static __inline__ verifier_state_t 616via_check_header2(uint32_t const **buffer, const uint32_t *buf_end, 617 drm_via_state_t *hc_state) 618{ 619 uint32_t cmd; 620 int hz_mode; 621 hazard_t hz; 622 const uint32_t *buf = *buffer; 623 const hazard_t *hz_table; 624 625 if ((buf_end - buf) < 2) { 626 DRM_ERROR 627 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n"); 628 return state_error; 629 } 630 buf++; 631 cmd = (*buf++ & 0xFFFF0000) >> 16; 632 633 switch (cmd) { 634 case HC_ParaType_CmdVdata: 635 if (via_check_prim_list(&buf, buf_end, hc_state)) 636 return state_error; 637 *buffer = buf; 638 return state_command; 639 case HC_ParaType_NotTex: 640 hz_table = table1; 641 break; 642 case HC_ParaType_Tex: 643 hc_state->texture = 0; 644 hz_table = table2; 645 break; 646 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)): 647 hc_state->texture = 1; 648 hz_table = table2; 649 break; 650 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)): 651 hz_table = table3; 652 break; 653 case HC_ParaType_Auto: 654 if (eat_words(&buf, buf_end, 2)) 655 return state_error; 656 *buffer = buf; 657 return state_command; 658 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)): 659 if (eat_words(&buf, buf_end, 32)) 660 return state_error; 661 *buffer = buf; 662 return state_command; 663 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)): 664 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)): 665 DRM_ERROR("Texture palettes are rejected because of " 666 "lack of info how to determine their size.\n"); 667 return state_error; 668 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)): 669 DRM_ERROR("Fog factor palettes are rejected because of " 670 "lack of info how to determine their size.\n"); 671 return state_error; 672 default: 673 674 /* 675 * There are some unimplemented HC_ParaTypes here, that 676 * need to be implemented if the Mesa driver is extended. 677 */ 678 679 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 " 680 "DMA subcommand: 0x%x. Previous dword: 0x%x\n", 681 cmd, *(buf - 2)); 682 *buffer = buf; 683 return state_error; 684 } 685 686 while (buf < buf_end) { 687 cmd = *buf++; 688 if ((hz = hz_table[cmd >> 24])) { 689 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) { 690 if (hz_mode == 1) { 691 buf--; 692 break; 693 } 694 return state_error; 695 } 696 } else if (hc_state->unfinished && 697 finish_current_sequence(hc_state)) { 698 return state_error; 699 } 700 } 701 if (hc_state->unfinished && finish_current_sequence(hc_state)) 702 return state_error; 703 *buffer = buf; 704 return state_command; 705} 706 707static __inline__ verifier_state_t 708via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer, 709 const uint32_t *buf_end, int *fire_count) 710{ 711 uint32_t cmd; 712 const uint32_t *buf = *buffer; 713 const uint32_t *next_fire; 714 int burst = 0; 715 716 next_fire = dev_priv->fire_offsets[*fire_count]; 717 buf++; 718 cmd = (*buf & 0xFFFF0000) >> 16; 719 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++); 720 switch (cmd) { 721 case HC_ParaType_CmdVdata: 722 while ((buf < buf_end) && 723 (*fire_count < dev_priv->num_fire_offsets) && 724 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) { 725 while (buf <= next_fire) { 726 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 727 (burst & 63), *buf++); 728 burst += 4; 729 } 730 if ((buf < buf_end) 731 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) 732 buf++; 733 734 if (++(*fire_count) < dev_priv->num_fire_offsets) 735 next_fire = dev_priv->fire_offsets[*fire_count]; 736 } 737 break; 738 default: 739 while (buf < buf_end) { 740 741 if (*buf == HC_HEADER2 || 742 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 || 743 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 || 744 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 745 break; 746 747 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 748 (burst & 63), *buf++); 749 burst += 4; 750 } 751 } 752 *buffer = buf; 753 return state_command; 754} 755 756static __inline__ int verify_mmio_address(uint32_t address) 757{ 758 if ((address > 0x3FF) && (address < 0xC00)) { 759 DRM_ERROR("Invalid VIDEO DMA command. " 760 "Attempt to access 3D- or command burst area.\n"); 761 return 1; 762 } else if ((address > 0xCFF) && (address < 0x1300)) { 763 DRM_ERROR("Invalid VIDEO DMA command. " 764 "Attempt to access PCI DMA area.\n"); 765 return 1; 766 } else if (address > 0x13FF) { 767 DRM_ERROR("Invalid VIDEO DMA command. " 768 "Attempt to access VGA registers.\n"); 769 return 1; 770 } 771 return 0; 772} 773 774static __inline__ int 775verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end, 776 uint32_t dwords) 777{ 778 const uint32_t *buf = *buffer; 779 780 if (buf_end - buf < dwords) { 781 DRM_ERROR("Illegal termination of video command.\n"); 782 return 1; 783 } 784 while (dwords--) { 785 if (*buf++) { 786 DRM_ERROR("Illegal video command tail.\n"); 787 return 1; 788 } 789 } 790 *buffer = buf; 791 return 0; 792} 793 794static __inline__ verifier_state_t 795via_check_header1(uint32_t const **buffer, const uint32_t * buf_end) 796{ 797 uint32_t cmd; 798 const uint32_t *buf = *buffer; 799 verifier_state_t ret = state_command; 800 801 while (buf < buf_end) { 802 cmd = *buf; 803 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) && 804 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) { 805 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 806 break; 807 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 808 "Attempt to access 3D- or command burst area.\n"); 809 ret = state_error; 810 break; 811 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) { 812 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 813 break; 814 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 815 "Attempt to access VGA registers.\n"); 816 ret = state_error; 817 break; 818 } else { 819 buf += 2; 820 } 821 } 822 *buffer = buf; 823 return ret; 824} 825 826static __inline__ verifier_state_t 827via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer, 828 const uint32_t *buf_end) 829{ 830 register uint32_t cmd; 831 const uint32_t *buf = *buffer; 832 833 while (buf < buf_end) { 834 cmd = *buf; 835 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 836 break; 837 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf); 838 buf++; 839 } 840 *buffer = buf; 841 return state_command; 842} 843 844static __inline__ verifier_state_t 845via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end) 846{ 847 uint32_t data; 848 const uint32_t *buf = *buffer; 849 850 if (buf_end - buf < 4) { 851 DRM_ERROR("Illegal termination of video header5 command\n"); 852 return state_error; 853 } 854 855 data = *buf++ & ~VIA_VIDEOMASK; 856 if (verify_mmio_address(data)) 857 return state_error; 858 859 data = *buf++; 860 if (*buf++ != 0x00F50000) { 861 DRM_ERROR("Illegal header5 header data\n"); 862 return state_error; 863 } 864 if (*buf++ != 0x00000000) { 865 DRM_ERROR("Illegal header5 header data\n"); 866 return state_error; 867 } 868 if (eat_words(&buf, buf_end, data)) 869 return state_error; 870 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 871 return state_error; 872 *buffer = buf; 873 return state_command; 874 875} 876 877static __inline__ verifier_state_t 878via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer, 879 const uint32_t *buf_end) 880{ 881 uint32_t addr, count, i; 882 const uint32_t *buf = *buffer; 883 884 addr = *buf++ & ~VIA_VIDEOMASK; 885 i = count = *buf; 886 buf += 3; 887 while (i--) 888 VIA_WRITE(addr, *buf++); 889 if (count & 3) 890 buf += 4 - (count & 3); 891 *buffer = buf; 892 return state_command; 893} 894 895static __inline__ verifier_state_t 896via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end) 897{ 898 uint32_t data; 899 const uint32_t *buf = *buffer; 900 uint32_t i; 901 902 if (buf_end - buf < 4) { 903 DRM_ERROR("Illegal termination of video header6 command\n"); 904 return state_error; 905 } 906 buf++; 907 data = *buf++; 908 if (*buf++ != 0x00F60000) { 909 DRM_ERROR("Illegal header6 header data\n"); 910 return state_error; 911 } 912 if (*buf++ != 0x00000000) { 913 DRM_ERROR("Illegal header6 header data\n"); 914 return state_error; 915 } 916 if ((buf_end - buf) < (data << 1)) { 917 DRM_ERROR("Illegal termination of video header6 command\n"); 918 return state_error; 919 } 920 for (i = 0; i < data; ++i) { 921 if (verify_mmio_address(*buf++)) 922 return state_error; 923 buf++; 924 } 925 data <<= 1; 926 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 927 return state_error; 928 *buffer = buf; 929 return state_command; 930} 931 932static __inline__ verifier_state_t 933via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer, 934 const uint32_t *buf_end) 935{ 936 937 uint32_t addr, count, i; 938 const uint32_t *buf = *buffer; 939 940 i = count = *++buf; 941 buf += 3; 942 while (i--) { 943 addr = *buf++; 944 VIA_WRITE(addr, *buf++); 945 } 946 count <<= 1; 947 if (count & 3) 948 buf += 4 - (count & 3); 949 *buffer = buf; 950 return state_command; 951} 952 953int 954via_verify_command_stream(const uint32_t * buf, unsigned int size, 955 struct drm_device * dev, int agp) 956{ 957 958 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 959 drm_via_state_t *hc_state = &dev_priv->hc_state; 960 drm_via_state_t saved_state = *hc_state; 961 uint32_t cmd; 962 const uint32_t *buf_end = buf + (size >> 2); 963 verifier_state_t state = state_command; 964 int cme_video; 965 int supported_3d; 966 967 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A || 968 dev_priv->chipset == VIA_DX9_0); 969 970 supported_3d = dev_priv->chipset != VIA_DX9_0; 971 972 hc_state->dev = dev; 973 hc_state->unfinished = no_sequence; 974 hc_state->map_cache = NULL; 975 hc_state->agp = agp; 976 hc_state->buf_start = buf; 977 dev_priv->num_fire_offsets = 0; 978 979 while (buf < buf_end) { 980 981 switch (state) { 982 case state_header2: 983 state = via_check_header2(&buf, buf_end, hc_state); 984 break; 985 case state_header1: 986 state = via_check_header1(&buf, buf_end); 987 break; 988 case state_vheader5: 989 state = via_check_vheader5(&buf, buf_end); 990 break; 991 case state_vheader6: 992 state = via_check_vheader6(&buf, buf_end); 993 break; 994 case state_command: 995 if ((HALCYON_HEADER2 == (cmd = *buf)) && 996 supported_3d) 997 state = state_header2; 998 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 999 state = state_header1; 1000 else if (cme_video 1001 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1002 state = state_vheader5; 1003 else if (cme_video 1004 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1005 state = state_vheader6; 1006 else if ((cmd == HALCYON_HEADER2) && !supported_3d) { 1007 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n"); 1008 state = state_error; 1009 } else { 1010 DRM_ERROR 1011 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1012 cmd); 1013 state = state_error; 1014 } 1015 break; 1016 case state_error: 1017 default: 1018 *hc_state = saved_state; 1019 return -EINVAL; 1020 } 1021 } 1022 if (state == state_error) { 1023 *hc_state = saved_state; 1024 return -EINVAL; 1025 } 1026 return 0; 1027} 1028 1029int 1030via_parse_command_stream(struct drm_device *dev, const uint32_t *buf, 1031 unsigned int size) 1032{ 1033 1034 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 1035 uint32_t cmd; 1036 const uint32_t *buf_end = buf + (size >> 2); 1037 verifier_state_t state = state_command; 1038 int fire_count = 0; 1039 1040 while (buf < buf_end) { 1041 1042 switch (state) { 1043 case state_header2: 1044 state = 1045 via_parse_header2(dev_priv, &buf, buf_end, 1046 &fire_count); 1047 break; 1048 case state_header1: 1049 state = via_parse_header1(dev_priv, &buf, buf_end); 1050 break; 1051 case state_vheader5: 1052 state = via_parse_vheader5(dev_priv, &buf, buf_end); 1053 break; 1054 case state_vheader6: 1055 state = via_parse_vheader6(dev_priv, &buf, buf_end); 1056 break; 1057 case state_command: 1058 if (HALCYON_HEADER2 == (cmd = *buf)) 1059 state = state_header2; 1060 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 1061 state = state_header1; 1062 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1063 state = state_vheader5; 1064 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1065 state = state_vheader6; 1066 else { 1067 DRM_ERROR 1068 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1069 cmd); 1070 state = state_error; 1071 } 1072 break; 1073 case state_error: 1074 default: 1075 return -EINVAL; 1076 } 1077 } 1078 if (state == state_error) 1079 return -EINVAL; 1080 return 0; 1081} 1082 1083static void 1084setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size) 1085{ 1086 int i; 1087 1088 for (i = 0; i < 256; ++i) 1089 table[i] = forbidden_command; 1090 1091 for (i = 0; i < size; ++i) 1092 table[init_table[i].code] = init_table[i].hz; 1093} 1094 1095void via_init_command_verifier(void) 1096{ 1097 setup_hazard_table(init_table1, table1, 1098 sizeof(init_table1) / sizeof(hz_init_t)); 1099 setup_hazard_table(init_table2, table2, 1100 sizeof(init_table2) / sizeof(hz_init_t)); 1101 setup_hazard_table(init_table3, table3, 1102 sizeof(init_table3) / sizeof(hz_init_t)); 1103} 1104