1/* 2 * Copyright 2004 The Unichrome Project. All Rights Reserved. 3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved. 4 * 5 * Permission is hereby granted, free of charge, to any person obtaining a 6 * copy of this software and associated documentation files (the "Software"), 7 * to deal in the Software without restriction, including without limitation 8 * the rights to use, copy, modify, merge, publish, distribute, sub license, 9 * and/or sell copies of the Software, and to permit persons to whom the 10 * Software is furnished to do so, subject to the following conditions: 11 * 12 * The above copyright notice and this permission notice (including the 13 * next paragraph) shall be included in all copies or substantial portions 14 * of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 22 * DEALINGS IN THE SOFTWARE. 23 * 24 * Author: Thomas Hellstrom 2004, 2005. 25 * This code was written using docs obtained under NDA from VIA Inc. 26 * 27 * Don't run this code directly on an AGP buffer. Due to cache problems it will 28 * be very slow. 29 */ 30 31#include "via_3d_reg.h" 32#include "drmP.h" 33#include "drm.h" 34#include "via_drm.h" 35#include "via_verifier.h" 36#include "via_drv.h" 37 38typedef enum { 39 state_command, 40 state_header2, 41 state_header1, 42 state_vheader5, 43 state_vheader6, 44 state_error 45} verifier_state_t; 46 47typedef enum { 48 no_check = 0, 49 check_for_header2, 50 check_for_header1, 51 check_for_header2_err, 52 check_for_header1_err, 53 check_for_fire, 54 check_z_buffer_addr0, 55 check_z_buffer_addr1, 56 check_z_buffer_addr_mode, 57 check_destination_addr0, 58 check_destination_addr1, 59 check_destination_addr_mode, 60 check_for_dummy, 61 check_for_dd, 62 check_texture_addr0, 63 check_texture_addr1, 64 check_texture_addr2, 65 check_texture_addr3, 66 check_texture_addr4, 67 check_texture_addr5, 68 check_texture_addr6, 69 check_texture_addr7, 70 check_texture_addr8, 71 check_texture_addr_mode, 72 check_for_vertex_count, 73 check_number_texunits, 74 forbidden_command 75} hazard_t; 76 77/* 78 * Associates each hazard above with a possible multi-command 79 * sequence. For example an address that is split over multiple 80 * commands and that needs to be checked at the first command 81 * that does not include any part of the address. 82 */ 83 84static drm_via_sequence_t seqs[] = { 85 no_sequence, 86 no_sequence, 87 no_sequence, 88 no_sequence, 89 no_sequence, 90 no_sequence, 91 z_address, 92 z_address, 93 z_address, 94 dest_address, 95 dest_address, 96 dest_address, 97 no_sequence, 98 no_sequence, 99 tex_address, 100 tex_address, 101 tex_address, 102 tex_address, 103 tex_address, 104 tex_address, 105 tex_address, 106 tex_address, 107 tex_address, 108 tex_address, 109 no_sequence 110}; 111 112typedef struct { 113 unsigned int code; 114 hazard_t hz; 115} hz_init_t; 116 117static hz_init_t init_table1[] = { 118 {0xf2, check_for_header2_err}, 119 {0xf0, check_for_header1_err}, 120 {0xee, check_for_fire}, 121 {0xcc, check_for_dummy}, 122 {0xdd, check_for_dd}, 123 {0x00, no_check}, 124 {0x10, check_z_buffer_addr0}, 125 {0x11, check_z_buffer_addr1}, 126 {0x12, check_z_buffer_addr_mode}, 127 {0x13, no_check}, 128 {0x14, no_check}, 129 {0x15, no_check}, 130 {0x23, no_check}, 131 {0x24, no_check}, 132 {0x33, no_check}, 133 {0x34, no_check}, 134 {0x35, no_check}, 135 {0x36, no_check}, 136 {0x37, no_check}, 137 {0x38, no_check}, 138 {0x39, no_check}, 139 {0x3A, no_check}, 140 {0x3B, no_check}, 141 {0x3C, no_check}, 142 {0x3D, no_check}, 143 {0x3E, no_check}, 144 {0x40, check_destination_addr0}, 145 {0x41, check_destination_addr1}, 146 {0x42, check_destination_addr_mode}, 147 {0x43, no_check}, 148 {0x44, no_check}, 149 {0x50, no_check}, 150 {0x51, no_check}, 151 {0x52, no_check}, 152 {0x53, no_check}, 153 {0x54, no_check}, 154 {0x55, no_check}, 155 {0x56, no_check}, 156 {0x57, no_check}, 157 {0x58, no_check}, 158 {0x70, no_check}, 159 {0x71, no_check}, 160 {0x78, no_check}, 161 {0x79, no_check}, 162 {0x7A, no_check}, 163 {0x7B, no_check}, 164 {0x7C, no_check}, 165 {0x7D, check_for_vertex_count} 166}; 167 168static hz_init_t init_table2[] = { 169 {0xf2, check_for_header2_err}, 170 {0xf0, check_for_header1_err}, 171 {0xee, check_for_fire}, 172 {0xcc, check_for_dummy}, 173 {0x00, check_texture_addr0}, 174 {0x01, check_texture_addr0}, 175 {0x02, check_texture_addr0}, 176 {0x03, check_texture_addr0}, 177 {0x04, check_texture_addr0}, 178 {0x05, check_texture_addr0}, 179 {0x06, check_texture_addr0}, 180 {0x07, check_texture_addr0}, 181 {0x08, check_texture_addr0}, 182 {0x09, check_texture_addr0}, 183 {0x20, check_texture_addr1}, 184 {0x21, check_texture_addr1}, 185 {0x22, check_texture_addr1}, 186 {0x23, check_texture_addr4}, 187 {0x2B, check_texture_addr3}, 188 {0x2C, check_texture_addr3}, 189 {0x2D, check_texture_addr3}, 190 {0x2E, check_texture_addr3}, 191 {0x2F, check_texture_addr3}, 192 {0x30, check_texture_addr3}, 193 {0x31, check_texture_addr3}, 194 {0x32, check_texture_addr3}, 195 {0x33, check_texture_addr3}, 196 {0x34, check_texture_addr3}, 197 {0x4B, check_texture_addr5}, 198 {0x4C, check_texture_addr6}, 199 {0x51, check_texture_addr7}, 200 {0x52, check_texture_addr8}, 201 {0x77, check_texture_addr2}, 202 {0x78, no_check}, 203 {0x79, no_check}, 204 {0x7A, no_check}, 205 {0x7B, check_texture_addr_mode}, 206 {0x7C, no_check}, 207 {0x7D, no_check}, 208 {0x7E, no_check}, 209 {0x7F, no_check}, 210 {0x80, no_check}, 211 {0x81, no_check}, 212 {0x82, no_check}, 213 {0x83, no_check}, 214 {0x85, no_check}, 215 {0x86, no_check}, 216 {0x87, no_check}, 217 {0x88, no_check}, 218 {0x89, no_check}, 219 {0x8A, no_check}, 220 {0x90, no_check}, 221 {0x91, no_check}, 222 {0x92, no_check}, 223 {0x93, no_check} 224}; 225 226static hz_init_t init_table3[] = { 227 {0xf2, check_for_header2_err}, 228 {0xf0, check_for_header1_err}, 229 {0xcc, check_for_dummy}, 230 {0x00, check_number_texunits} 231}; 232 233static hazard_t table1[256]; 234static hazard_t table2[256]; 235static hazard_t table3[256]; 236 237static __inline__ int 238eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words) 239{ 240 if ((buf_end - *buf) >= num_words) { 241 *buf += num_words; 242 return 0; 243 } 244 DRM_ERROR("Illegal termination of DMA command buffer\n"); 245 return 1; 246} 247 248/* 249 * Partially stolen from drm_memory.h 250 */ 251 252static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq, 253 unsigned long offset, 254 unsigned long size, 255 drm_device_t * dev) 256{ 257 struct list_head *list; 258 drm_map_list_t *r_list; 259 drm_local_map_t *map = seq->map_cache; 260 261 if (map && map->offset <= offset 262 && (offset + size) <= (map->offset + map->size)) { 263 return map; 264 } 265 266 list_for_each(list, &dev->maplist->head) { 267 r_list = (drm_map_list_t *) list; 268 map = r_list->map; 269 if (!map) 270 continue; 271 if (map->offset <= offset 272 && (offset + size) <= (map->offset + map->size) 273 && !(map->flags & _DRM_RESTRICTED) 274 && (map->type == _DRM_AGP)) { 275 seq->map_cache = map; 276 return map; 277 } 278 } 279 return NULL; 280} 281 282 283static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq) 284{ 285 switch (cur_seq->unfinished) { 286 case z_address: 287 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr); 288 break; 289 case dest_address: 290 DRM_DEBUG("Destination start address is 0x%x\n", 291 cur_seq->d_addr); 292 break; 293 case tex_address: 294 if (cur_seq->agp_texture) { 295 unsigned start = 296 cur_seq->tex_level_lo[cur_seq->texture]; 297 unsigned end = cur_seq->tex_level_hi[cur_seq->texture]; 298 unsigned long lo = ~0, hi = 0, tmp; 299 uint32_t *addr, *pitch, *height, tex; 300 unsigned i; 301 int npot; 302 303 if (end > 9) 304 end = 9; 305 if (start > 9) 306 start = 9; 307 308 addr = 309 &(cur_seq->t_addr[tex = cur_seq->texture][start]); 310 pitch = &(cur_seq->pitch[tex][start]); 311 height = &(cur_seq->height[tex][start]); 312 npot = cur_seq->tex_npot[tex]; 313 for (i = start; i <= end; ++i) { 314 tmp = *addr++; 315 if (tmp < lo) 316 lo = tmp; 317 if (i == 0 && npot) 318 tmp += (*height++ * *pitch++); 319 else 320 tmp += (*height++ << *pitch++); 321 if (tmp > hi) 322 hi = tmp; 323 } 324 325 if (!via_drm_lookup_agp_map 326 (cur_seq, lo, hi - lo, cur_seq->dev)) { 327 DRM_ERROR 328 ("AGP texture is not in allowed map\n"); 329 return 2; 330 } 331 } 332 break; 333 default: 334 break; 335 } 336 cur_seq->unfinished = no_sequence; 337 return 0; 338} 339 340static __inline__ int 341investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq) 342{ 343 register uint32_t tmp, *tmp_addr; 344 345 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) { 346 int ret; 347 if ((ret = finish_current_sequence(cur_seq))) 348 return ret; 349 } 350 351 switch (hz) { 352 case check_for_header2: 353 if (cmd == HALCYON_HEADER2) 354 return 1; 355 return 0; 356 case check_for_header1: 357 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 358 return 1; 359 return 0; 360 case check_for_header2_err: 361 if (cmd == HALCYON_HEADER2) 362 return 1; 363 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n"); 364 break; 365 case check_for_header1_err: 366 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 367 return 1; 368 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n"); 369 break; 370 case check_for_fire: 371 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD) 372 return 1; 373 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n"); 374 break; 375 case check_for_dummy: 376 if (HC_DUMMY == cmd) 377 return 0; 378 DRM_ERROR("Illegal DMA HC_DUMMY command\n"); 379 break; 380 case check_for_dd: 381 if (0xdddddddd == cmd) 382 return 0; 383 DRM_ERROR("Illegal DMA 0xdddddddd command\n"); 384 break; 385 case check_z_buffer_addr0: 386 cur_seq->unfinished = z_address; 387 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) | 388 (cmd & 0x00FFFFFF); 389 return 0; 390 case check_z_buffer_addr1: 391 cur_seq->unfinished = z_address; 392 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) | 393 ((cmd & 0xFF) << 24); 394 return 0; 395 case check_z_buffer_addr_mode: 396 cur_seq->unfinished = z_address; 397 if ((cmd & 0x0000C000) == 0) 398 return 0; 399 DRM_ERROR("Attempt to place Z buffer in system memory\n"); 400 return 2; 401 case check_destination_addr0: 402 cur_seq->unfinished = dest_address; 403 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) | 404 (cmd & 0x00FFFFFF); 405 return 0; 406 case check_destination_addr1: 407 cur_seq->unfinished = dest_address; 408 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) | 409 ((cmd & 0xFF) << 24); 410 return 0; 411 case check_destination_addr_mode: 412 cur_seq->unfinished = dest_address; 413 if ((cmd & 0x0000C000) == 0) 414 return 0; 415 DRM_ERROR 416 ("Attempt to place 3D drawing buffer in system memory\n"); 417 return 2; 418 case check_texture_addr0: 419 cur_seq->unfinished = tex_address; 420 tmp = (cmd >> 24); 421 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 422 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF); 423 return 0; 424 case check_texture_addr1: 425 cur_seq->unfinished = tex_address; 426 tmp = ((cmd >> 24) - 0x20); 427 tmp += tmp << 1; 428 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 429 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 430 tmp_addr++; 431 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16); 432 tmp_addr++; 433 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8); 434 return 0; 435 case check_texture_addr2: 436 cur_seq->unfinished = tex_address; 437 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F; 438 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6; 439 return 0; 440 case check_texture_addr3: 441 cur_seq->unfinished = tex_address; 442 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit); 443 if (tmp == 0 && 444 (cmd & HC_HTXnEnPit_MASK)) { 445 cur_seq->pitch[cur_seq->texture][tmp] = 446 (cmd & HC_HTXnLnPit_MASK); 447 cur_seq->tex_npot[cur_seq->texture] = 1; 448 } else { 449 cur_seq->pitch[cur_seq->texture][tmp] = 450 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT; 451 cur_seq->tex_npot[cur_seq->texture] = 0; 452 if (cmd & 0x000FFFFF) { 453 DRM_ERROR 454 ("Unimplemented texture level 0 pitch mode.\n"); 455 return 2; 456 } 457 } 458 return 0; 459 case check_texture_addr4: 460 cur_seq->unfinished = tex_address; 461 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9]; 462 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 463 return 0; 464 case check_texture_addr5: 465 case check_texture_addr6: 466 cur_seq->unfinished = tex_address; 467 /* 468 * Texture width. We don't care since we have the pitch. 469 */ 470 return 0; 471 case check_texture_addr7: 472 cur_seq->unfinished = tex_address; 473 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 474 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20); 475 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16); 476 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12); 477 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8); 478 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4); 479 tmp_addr[0] = 1 << (cmd & 0x0000000F); 480 return 0; 481 case check_texture_addr8: 482 cur_seq->unfinished = tex_address; 483 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 484 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12); 485 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8); 486 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4); 487 tmp_addr[6] = 1 << (cmd & 0x0000000F); 488 return 0; 489 case check_texture_addr_mode: 490 cur_seq->unfinished = tex_address; 491 if (2 == (tmp = cmd & 0x00000003)) { 492 DRM_ERROR 493 ("Attempt to fetch texture from system memory.\n"); 494 return 2; 495 } 496 cur_seq->agp_texture = (tmp == 3); 497 cur_seq->tex_palette_size[cur_seq->texture] = 498 (cmd >> 16) & 0x000000007; 499 return 0; 500 case check_for_vertex_count: 501 cur_seq->vertex_count = cmd & 0x0000FFFF; 502 return 0; 503 case check_number_texunits: 504 cur_seq->multitex = (cmd >> 3) & 1; 505 return 0; 506 default: 507 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd); 508 return 2; 509 } 510 return 2; 511} 512 513static __inline__ int 514via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end, 515 drm_via_state_t * cur_seq) 516{ 517 drm_via_private_t *dev_priv = 518 (drm_via_private_t *) cur_seq->dev->dev_private; 519 uint32_t a_fire, bcmd, dw_count; 520 int ret = 0; 521 int have_fire; 522 const uint32_t *buf = *buffer; 523 524 while (buf < buf_end) { 525 have_fire = 0; 526 if ((buf_end - buf) < 2) { 527 DRM_ERROR 528 ("Unexpected termination of primitive list.\n"); 529 ret = 1; 530 break; 531 } 532 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB) 533 break; 534 bcmd = *buf++; 535 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) { 536 DRM_ERROR("Expected Vertex List A command, got 0x%x\n", 537 *buf); 538 ret = 1; 539 break; 540 } 541 a_fire = 542 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK | 543 HC_HE3Fire_MASK; 544 545 /* 546 * How many dwords per vertex ? 547 */ 548 549 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) { 550 DRM_ERROR("Illegal B command vertex data for AGP.\n"); 551 ret = 1; 552 break; 553 } 554 555 dw_count = 0; 556 if (bcmd & (1 << 7)) 557 dw_count += (cur_seq->multitex) ? 2 : 1; 558 if (bcmd & (1 << 8)) 559 dw_count += (cur_seq->multitex) ? 2 : 1; 560 if (bcmd & (1 << 9)) 561 dw_count++; 562 if (bcmd & (1 << 10)) 563 dw_count++; 564 if (bcmd & (1 << 11)) 565 dw_count++; 566 if (bcmd & (1 << 12)) 567 dw_count++; 568 if (bcmd & (1 << 13)) 569 dw_count++; 570 if (bcmd & (1 << 14)) 571 dw_count++; 572 573 while (buf < buf_end) { 574 if (*buf == a_fire) { 575 if (dev_priv->num_fire_offsets >= 576 VIA_FIRE_BUF_SIZE) { 577 DRM_ERROR("Fire offset buffer full.\n"); 578 ret = 1; 579 break; 580 } 581 dev_priv->fire_offsets[dev_priv-> 582 num_fire_offsets++] = 583 buf; 584 have_fire = 1; 585 buf++; 586 if (buf < buf_end && *buf == a_fire) 587 buf++; 588 break; 589 } 590 if ((*buf == HALCYON_HEADER2) || 591 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) { 592 DRM_ERROR("Missing Vertex Fire command, " 593 "Stray Vertex Fire command or verifier " 594 "lost sync.\n"); 595 ret = 1; 596 break; 597 } 598 if ((ret = eat_words(&buf, buf_end, dw_count))) 599 break; 600 } 601 if (buf >= buf_end && !have_fire) { 602 DRM_ERROR("Missing Vertex Fire command or verifier " 603 "lost sync.\n"); 604 ret = 1; 605 break; 606 } 607 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) { 608 DRM_ERROR("AGP Primitive list end misaligned.\n"); 609 ret = 1; 610 break; 611 } 612 } 613 *buffer = buf; 614 return ret; 615} 616 617static __inline__ verifier_state_t 618via_check_header2(uint32_t const **buffer, const uint32_t * buf_end, 619 drm_via_state_t * hc_state) 620{ 621 uint32_t cmd; 622 int hz_mode; 623 hazard_t hz; 624 const uint32_t *buf = *buffer; 625 const hazard_t *hz_table; 626 627 if ((buf_end - buf) < 2) { 628 DRM_ERROR 629 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n"); 630 return state_error; 631 } 632 buf++; 633 cmd = (*buf++ & 0xFFFF0000) >> 16; 634 635 switch (cmd) { 636 case HC_ParaType_CmdVdata: 637 if (via_check_prim_list(&buf, buf_end, hc_state)) 638 return state_error; 639 *buffer = buf; 640 return state_command; 641 case HC_ParaType_NotTex: 642 hz_table = table1; 643 break; 644 case HC_ParaType_Tex: 645 hc_state->texture = 0; 646 hz_table = table2; 647 break; 648 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)): 649 hc_state->texture = 1; 650 hz_table = table2; 651 break; 652 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)): 653 hz_table = table3; 654 break; 655 case HC_ParaType_Auto: 656 if (eat_words(&buf, buf_end, 2)) 657 return state_error; 658 *buffer = buf; 659 return state_command; 660 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)): 661 if (eat_words(&buf, buf_end, 32)) 662 return state_error; 663 *buffer = buf; 664 return state_command; 665 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)): 666 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)): 667 DRM_ERROR("Texture palettes are rejected because of " 668 "lack of info how to determine their size.\n"); 669 return state_error; 670 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)): 671 DRM_ERROR("Fog factor palettes are rejected because of " 672 "lack of info how to determine their size.\n"); 673 return state_error; 674 default: 675 676 /* 677 * There are some unimplemented HC_ParaTypes here, that 678 * need to be implemented if the Mesa driver is extended. 679 */ 680 681 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 " 682 "DMA subcommand: 0x%x. Previous dword: 0x%x\n", 683 cmd, *(buf - 2)); 684 *buffer = buf; 685 return state_error; 686 } 687 688 while (buf < buf_end) { 689 cmd = *buf++; 690 if ((hz = hz_table[cmd >> 24])) { 691 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) { 692 if (hz_mode == 1) { 693 buf--; 694 break; 695 } 696 return state_error; 697 } 698 } else if (hc_state->unfinished && 699 finish_current_sequence(hc_state)) { 700 return state_error; 701 } 702 } 703 if (hc_state->unfinished && finish_current_sequence(hc_state)) { 704 return state_error; 705 } 706 *buffer = buf; 707 return state_command; 708} 709 710static __inline__ verifier_state_t 711via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer, 712 const uint32_t * buf_end, int *fire_count) 713{ 714 uint32_t cmd; 715 const uint32_t *buf = *buffer; 716 const uint32_t *next_fire; 717 int burst = 0; 718 719 next_fire = dev_priv->fire_offsets[*fire_count]; 720 buf++; 721 cmd = (*buf & 0xFFFF0000) >> 16; 722 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++); 723 switch (cmd) { 724 case HC_ParaType_CmdVdata: 725 while ((buf < buf_end) && 726 (*fire_count < dev_priv->num_fire_offsets) && 727 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) { 728 while (buf <= next_fire) { 729 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 730 (burst & 63), *buf++); 731 burst += 4; 732 } 733 if ((buf < buf_end) 734 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) 735 buf++; 736 737 if (++(*fire_count) < dev_priv->num_fire_offsets) 738 next_fire = dev_priv->fire_offsets[*fire_count]; 739 } 740 break; 741 default: 742 while (buf < buf_end) { 743 744 if (*buf == HC_HEADER2 || 745 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 || 746 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 || 747 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 748 break; 749 750 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 751 (burst & 63), *buf++); 752 burst += 4; 753 } 754 } 755 *buffer = buf; 756 return state_command; 757} 758 759static __inline__ int verify_mmio_address(uint32_t address) 760{ 761 if ((address > 0x3FF) && (address < 0xC00)) { 762 DRM_ERROR("Invalid VIDEO DMA command. " 763 "Attempt to access 3D- or command burst area.\n"); 764 return 1; 765 } else if ((address > 0xCFF) && (address < 0x1300)) { 766 DRM_ERROR("Invalid VIDEO DMA command. " 767 "Attempt to access PCI DMA area.\n"); 768 return 1; 769 } else if (address > 0x13FF) { 770 DRM_ERROR("Invalid VIDEO DMA command. " 771 "Attempt to access VGA registers.\n"); 772 return 1; 773 } 774 return 0; 775} 776 777static __inline__ int 778verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end, 779 uint32_t dwords) 780{ 781 const uint32_t *buf = *buffer; 782 783 if (buf_end - buf < dwords) { 784 DRM_ERROR("Illegal termination of video command.\n"); 785 return 1; 786 } 787 while (dwords--) { 788 if (*buf++) { 789 DRM_ERROR("Illegal video command tail.\n"); 790 return 1; 791 } 792 } 793 *buffer = buf; 794 return 0; 795} 796 797static __inline__ verifier_state_t 798via_check_header1(uint32_t const **buffer, const uint32_t * buf_end) 799{ 800 uint32_t cmd; 801 const uint32_t *buf = *buffer; 802 verifier_state_t ret = state_command; 803 804 while (buf < buf_end) { 805 cmd = *buf; 806 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) && 807 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) { 808 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 809 break; 810 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 811 "Attempt to access 3D- or command burst area.\n"); 812 ret = state_error; 813 break; 814 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) { 815 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 816 break; 817 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 818 "Attempt to access VGA registers.\n"); 819 ret = state_error; 820 break; 821 } else { 822 buf += 2; 823 } 824 } 825 *buffer = buf; 826 return ret; 827} 828 829static __inline__ verifier_state_t 830via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer, 831 const uint32_t * buf_end) 832{ 833 register uint32_t cmd; 834 const uint32_t *buf = *buffer; 835 836 while (buf < buf_end) { 837 cmd = *buf; 838 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 839 break; 840 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf); 841 buf++; 842 } 843 *buffer = buf; 844 return state_command; 845} 846 847static __inline__ verifier_state_t 848via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end) 849{ 850 uint32_t data; 851 const uint32_t *buf = *buffer; 852 853 if (buf_end - buf < 4) { 854 DRM_ERROR("Illegal termination of video header5 command\n"); 855 return state_error; 856 } 857 858 data = *buf++ & ~VIA_VIDEOMASK; 859 if (verify_mmio_address(data)) 860 return state_error; 861 862 data = *buf++; 863 if (*buf++ != 0x00F50000) { 864 DRM_ERROR("Illegal header5 header data\n"); 865 return state_error; 866 } 867 if (*buf++ != 0x00000000) { 868 DRM_ERROR("Illegal header5 header data\n"); 869 return state_error; 870 } 871 if (eat_words(&buf, buf_end, data)) 872 return state_error; 873 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 874 return state_error; 875 *buffer = buf; 876 return state_command; 877 878} 879 880static __inline__ verifier_state_t 881via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer, 882 const uint32_t * buf_end) 883{ 884 uint32_t addr, count, i; 885 const uint32_t *buf = *buffer; 886 887 addr = *buf++ & ~VIA_VIDEOMASK; 888 i = count = *buf; 889 buf += 3; 890 while (i--) { 891 VIA_WRITE(addr, *buf++); 892 } 893 if (count & 3) 894 buf += 4 - (count & 3); 895 *buffer = buf; 896 return state_command; 897} 898 899static __inline__ verifier_state_t 900via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end) 901{ 902 uint32_t data; 903 const uint32_t *buf = *buffer; 904 uint32_t i; 905 906 if (buf_end - buf < 4) { 907 DRM_ERROR("Illegal termination of video header6 command\n"); 908 return state_error; 909 } 910 buf++; 911 data = *buf++; 912 if (*buf++ != 0x00F60000) { 913 DRM_ERROR("Illegal header6 header data\n"); 914 return state_error; 915 } 916 if (*buf++ != 0x00000000) { 917 DRM_ERROR("Illegal header6 header data\n"); 918 return state_error; 919 } 920 if ((buf_end - buf) < (data << 1)) { 921 DRM_ERROR("Illegal termination of video header6 command\n"); 922 return state_error; 923 } 924 for (i = 0; i < data; ++i) { 925 if (verify_mmio_address(*buf++)) 926 return state_error; 927 buf++; 928 } 929 data <<= 1; 930 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 931 return state_error; 932 *buffer = buf; 933 return state_command; 934} 935 936static __inline__ verifier_state_t 937via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer, 938 const uint32_t * buf_end) 939{ 940 941 uint32_t addr, count, i; 942 const uint32_t *buf = *buffer; 943 944 i = count = *++buf; 945 buf += 3; 946 while (i--) { 947 addr = *buf++; 948 VIA_WRITE(addr, *buf++); 949 } 950 count <<= 1; 951 if (count & 3) 952 buf += 4 - (count & 3); 953 *buffer = buf; 954 return state_command; 955} 956 957int 958via_verify_command_stream(const uint32_t * buf, unsigned int size, 959 drm_device_t * dev, int agp) 960{ 961 962 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 963 drm_via_state_t *hc_state = &dev_priv->hc_state; 964 drm_via_state_t saved_state = *hc_state; 965 uint32_t cmd; 966 const uint32_t *buf_end = buf + (size >> 2); 967 verifier_state_t state = state_command; 968 int cme_video; 969 int supported_3d; 970 971 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A || 972 dev_priv->chipset == VIA_DX9_0); 973 974 supported_3d = dev_priv->chipset != VIA_DX9_0; 975 976 hc_state->dev = dev; 977 hc_state->unfinished = no_sequence; 978 hc_state->map_cache = NULL; 979 hc_state->agp = agp; 980 hc_state->buf_start = buf; 981 dev_priv->num_fire_offsets = 0; 982 983 while (buf < buf_end) { 984 985 switch (state) { 986 case state_header2: 987 state = via_check_header2(&buf, buf_end, hc_state); 988 break; 989 case state_header1: 990 state = via_check_header1(&buf, buf_end); 991 break; 992 case state_vheader5: 993 state = via_check_vheader5(&buf, buf_end); 994 break; 995 case state_vheader6: 996 state = via_check_vheader6(&buf, buf_end); 997 break; 998 case state_command: 999 if ((HALCYON_HEADER2 == (cmd = *buf)) && 1000 supported_3d) 1001 state = state_header2; 1002 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 1003 state = state_header1; 1004 else if (cme_video 1005 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1006 state = state_vheader5; 1007 else if (cme_video 1008 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1009 state = state_vheader6; 1010 else if ((cmd == HALCYON_HEADER2) && !supported_3d) { 1011 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n"); 1012 state = state_error; 1013 } else { 1014 DRM_ERROR 1015 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1016 cmd); 1017 state = state_error; 1018 } 1019 break; 1020 case state_error: 1021 default: 1022 *hc_state = saved_state; 1023 return DRM_ERR(EINVAL); 1024 } 1025 } 1026 if (state == state_error) { 1027 *hc_state = saved_state; 1028 return DRM_ERR(EINVAL); 1029 } 1030 return 0; 1031} 1032 1033int 1034via_parse_command_stream(drm_device_t * dev, const uint32_t * buf, 1035 unsigned int size) 1036{ 1037 1038 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 1039 uint32_t cmd; 1040 const uint32_t *buf_end = buf + (size >> 2); 1041 verifier_state_t state = state_command; 1042 int fire_count = 0; 1043 1044 while (buf < buf_end) { 1045 1046 switch (state) { 1047 case state_header2: 1048 state = 1049 via_parse_header2(dev_priv, &buf, buf_end, 1050 &fire_count); 1051 break; 1052 case state_header1: 1053 state = via_parse_header1(dev_priv, &buf, buf_end); 1054 break; 1055 case state_vheader5: 1056 state = via_parse_vheader5(dev_priv, &buf, buf_end); 1057 break; 1058 case state_vheader6: 1059 state = via_parse_vheader6(dev_priv, &buf, buf_end); 1060 break; 1061 case state_command: 1062 if (HALCYON_HEADER2 == (cmd = *buf)) 1063 state = state_header2; 1064 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 1065 state = state_header1; 1066 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1067 state = state_vheader5; 1068 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1069 state = state_vheader6; 1070 else { 1071 DRM_ERROR 1072 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1073 cmd); 1074 state = state_error; 1075 } 1076 break; 1077 case state_error: 1078 default: 1079 return DRM_ERR(EINVAL); 1080 } 1081 } 1082 if (state == state_error) { 1083 return DRM_ERR(EINVAL); 1084 } 1085 return 0; 1086} 1087 1088static void 1089setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size) 1090{ 1091 int i; 1092 1093 for (i = 0; i < 256; ++i) { 1094 table[i] = forbidden_command; 1095 } 1096 1097 for (i = 0; i < size; ++i) { 1098 table[init_table[i].code] = init_table[i].hz; 1099 } 1100} 1101 1102void via_init_command_verifier(void) 1103{ 1104 setup_hazard_table(init_table1, table1, 1105 sizeof(init_table1) / sizeof(hz_init_t)); 1106 setup_hazard_table(init_table2, table2, 1107 sizeof(init_table2) / sizeof(hz_init_t)); 1108 setup_hazard_table(init_table3, table3, 1109 sizeof(init_table3) / sizeof(hz_init_t)); 1110} 1111