kevin/linux
1
Fork 0
Code
3ae9da1c99
linux/drivers/gpu/drm/via/via_verifier.c
Dave Airlie c0e09200dc drm: reorganise drm tree to be more future proof. 
With the coming of kernel based modesetting and the memory manager stuff,
the everything in one directory approach was getting very ugly and
starting to be unmanageable.

This restructures the drm along the lines of other kernel components.

It creates a drivers/gpu/drm directory and moves the hw drivers into
subdirectores. It moves the includes into an include/drm, and
sets up the unifdef for the userspace headers we should be exporting.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-07-14 10:45:01 +10:00

1117 lines
28 KiB
C
Raw Blame History

/*
* Copyright 2004 The Unichrome Project. All Rights Reserved.
* Copyright 2005 Thomas Hellstrom. All Rights Reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sub license,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice (including the
* next paragraph) shall be included in all copies or substantial portions
* of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
* THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
* OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Author: Thomas Hellstrom 2004, 2005.
* This code was written using docs obtained under NDA from VIA Inc.
*
* Don't run this code directly on an AGP buffer. Due to cache problems it will
* be very slow.
*/
#include "via_3d_reg.h"
#include "drmP.h"
#include "drm.h"
#include "via_drm.h"
#include "via_verifier.h"
#include "via_drv.h"
typedef enum {
state_command,
state_header2,
state_header1,
state_vheader5,
state_vheader6,
state_error
} verifier_state_t;
typedef enum {
no_check = 0,
check_for_header2,
check_for_header1,
check_for_header2_err,
check_for_header1_err,
check_for_fire,
check_z_buffer_addr0,
check_z_buffer_addr1,
check_z_buffer_addr_mode,
check_destination_addr0,
check_destination_addr1,
check_destination_addr_mode,
check_for_dummy,
check_for_dd,
check_texture_addr0,
check_texture_addr1,
check_texture_addr2,
check_texture_addr3,
check_texture_addr4,
check_texture_addr5,
check_texture_addr6,
check_texture_addr7,
check_texture_addr8,
check_texture_addr_mode,
check_for_vertex_count,
check_number_texunits,
forbidden_command
} hazard_t;
/*
* Associates each hazard above with a possible multi-command
* sequence. For example an address that is split over multiple
* commands and that needs to be checked at the first command
* that does not include any part of the address.
*/
static drm_via_sequence_t seqs[] = {
no_sequence,
no_sequence,
no_sequence,
no_sequence,
no_sequence,
no_sequence,
z_address,
z_address,
z_address,
dest_address,
dest_address,
dest_address,
no_sequence,
no_sequence,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
tex_address,
no_sequence
};
typedef struct {
unsigned int code;
hazard_t hz;
} hz_init_t;
static hz_init_t init_table1[] = {
{0xf2, check_for_header2_err},
{0xf0, check_for_header1_err},
{0xee, check_for_fire},
{0xcc, check_for_dummy},
{0xdd, check_for_dd},
{0x00, no_check},
{0x10, check_z_buffer_addr0},
{0x11, check_z_buffer_addr1},
{0x12, check_z_buffer_addr_mode},
{0x13, no_check},
{0x14, no_check},
{0x15, no_check},
{0x23, no_check},
{0x24, no_check},
{0x33, no_check},
{0x34, no_check},
{0x35, no_check},
{0x36, no_check},
{0x37, no_check},
{0x38, no_check},
{0x39, no_check},
{0x3A, no_check},
{0x3B, no_check},
{0x3C, no_check},
{0x3D, no_check},
{0x3E, no_check},
{0x40, check_destination_addr0},
{0x41, check_destination_addr1},
{0x42, check_destination_addr_mode},
{0x43, no_check},
{0x44, no_check},
{0x50, no_check},
{0x51, no_check},
{0x52, no_check},
{0x53, no_check},
{0x54, no_check},
{0x55, no_check},
{0x56, no_check},
{0x57, no_check},
{0x58, no_check},
{0x70, no_check},
{0x71, no_check},
{0x78, no_check},
{0x79, no_check},
{0x7A, no_check},
{0x7B, no_check},
{0x7C, no_check},
{0x7D, check_for_vertex_count}
};
static hz_init_t init_table2[] = {
{0xf2, check_for_header2_err},
{0xf0, check_for_header1_err},
{0xee, check_for_fire},
{0xcc, check_for_dummy},
{0x00, check_texture_addr0},
{0x01, check_texture_addr0},
{0x02, check_texture_addr0},
{0x03, check_texture_addr0},
{0x04, check_texture_addr0},
{0x05, check_texture_addr0},
{0x06, check_texture_addr0},
{0x07, check_texture_addr0},
{0x08, check_texture_addr0},
{0x09, check_texture_addr0},
{0x20, check_texture_addr1},
{0x21, check_texture_addr1},
{0x22, check_texture_addr1},
{0x23, check_texture_addr4},
{0x2B, check_texture_addr3},
{0x2C, check_texture_addr3},
{0x2D, check_texture_addr3},
{0x2E, check_texture_addr3},
{0x2F, check_texture_addr3},
{0x30, check_texture_addr3},
{0x31, check_texture_addr3},
{0x32, check_texture_addr3},
{0x33, check_texture_addr3},
{0x34, check_texture_addr3},
{0x4B, check_texture_addr5},
{0x4C, check_texture_addr6},
{0x51, check_texture_addr7},
{0x52, check_texture_addr8},
{0x77, check_texture_addr2},
{0x78, no_check},
{0x79, no_check},
{0x7A, no_check},
{0x7B, check_texture_addr_mode},
{0x7C, no_check},
{0x7D, no_check},
{0x7E, no_check},
{0x7F, no_check},
{0x80, no_check},
{0x81, no_check},
{0x82, no_check},
{0x83, no_check},
{0x85, no_check},
{0x86, no_check},
{0x87, no_check},
{0x88, no_check},
{0x89, no_check},
{0x8A, no_check},
{0x90, no_check},
{0x91, no_check},
{0x92, no_check},
{0x93, no_check}
};
static hz_init_t init_table3[] = {
{0xf2, check_for_header2_err},
{0xf0, check_for_header1_err},
{0xcc, check_for_dummy},
{0x00, check_number_texunits}
};
static hazard_t table1[256];
static hazard_t table2[256];
static hazard_t table3[256];
static __inline__ int
eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
{
if ((buf_end - *buf) >= num_words) {
*buf += num_words;
return 0;
}
DRM_ERROR("Illegal termination of DMA command buffer\n");
return 1;
}
/*
* Partially stolen from drm_memory.h
*/
static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
unsigned long offset,
unsigned long size,
struct drm_device * dev)
{
struct drm_map_list *r_list;
drm_local_map_t *map = seq->map_cache;
if (map && map->offset <= offset
&& (offset + size) <= (map->offset + map->size)) {
return map;
}
list_for_each_entry(r_list, &dev->maplist, head) {
map = r_list->map;
if (!map)
continue;
if (map->offset <= offset
&& (offset + size) <= (map->offset + map->size)
&& !(map->flags & _DRM_RESTRICTED)
&& (map->type == _DRM_AGP)) {
seq->map_cache = map;
return map;
}
}
return NULL;
}
/*
* Require that all AGP texture levels reside in the same AGP map which should
* be mappable by the client. This is not a big restriction.
* FIXME: To actually enforce this security policy strictly, drm_rmmap
* would have to wait for dma quiescent before removing an AGP map.
* The via_drm_lookup_agp_map call in reality seems to take
* very little CPU time.
*/
static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
{
switch (cur_seq->unfinished) {
case z_address:
DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
break;
case dest_address:
DRM_DEBUG("Destination start address is 0x%x\n",
cur_seq->d_addr);
break;
case tex_address:
if (cur_seq->agp_texture) {
unsigned start =
cur_seq->tex_level_lo[cur_seq->texture];
unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
unsigned long lo = ~0, hi = 0, tmp;
uint32_t *addr, *pitch, *height, tex;
unsigned i;
int npot;
if (end > 9)
end = 9;
if (start > 9)
start = 9;
addr =
&(cur_seq->t_addr[tex = cur_seq->texture][start]);
pitch = &(cur_seq->pitch[tex][start]);
height = &(cur_seq->height[tex][start]);
npot = cur_seq->tex_npot[tex];
for (i = start; i <= end; ++i) {
tmp = *addr++;
if (tmp < lo)
lo = tmp;
if (i == 0 && npot)
tmp += (*height++ * *pitch++);
else
tmp += (*height++ << *pitch++);
if (tmp > hi)
hi = tmp;
}
if (!via_drm_lookup_agp_map
(cur_seq, lo, hi - lo, cur_seq->dev)) {
DRM_ERROR
("AGP texture is not in allowed map\n");
return 2;
}
}
break;
default:
break;
}
cur_seq->unfinished = no_sequence;
return 0;
}
static __inline__ int
investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
{
register uint32_t tmp, *tmp_addr;
if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
int ret;
if ((ret = finish_current_sequence(cur_seq)))
return ret;
}
switch (hz) {
case check_for_header2:
if (cmd == HALCYON_HEADER2)
return 1;
return 0;
case check_for_header1:
if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
return 1;
return 0;
case check_for_header2_err:
if (cmd == HALCYON_HEADER2)
return 1;
DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
break;
case check_for_header1_err:
if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
return 1;
DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
break;
case check_for_fire:
if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
return 1;
DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
break;
case check_for_dummy:
if (HC_DUMMY == cmd)
return 0;
DRM_ERROR("Illegal DMA HC_DUMMY command\n");
break;
case check_for_dd:
if (0xdddddddd == cmd)
return 0;
DRM_ERROR("Illegal DMA 0xdddddddd command\n");
break;
case check_z_buffer_addr0:
cur_seq->unfinished = z_address;
cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
(cmd & 0x00FFFFFF);
return 0;
case check_z_buffer_addr1:
cur_seq->unfinished = z_address;
cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
((cmd & 0xFF) << 24);
return 0;
case check_z_buffer_addr_mode:
cur_seq->unfinished = z_address;
if ((cmd & 0x0000C000) == 0)
return 0;
DRM_ERROR("Attempt to place Z buffer in system memory\n");
return 2;
case check_destination_addr0:
cur_seq->unfinished = dest_address;
cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
(cmd & 0x00FFFFFF);
return 0;
case check_destination_addr1:
cur_seq->unfinished = dest_address;
cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
((cmd & 0xFF) << 24);
return 0;
case check_destination_addr_mode:
cur_seq->unfinished = dest_address;
if ((cmd & 0x0000C000) == 0)
return 0;
DRM_ERROR
("Attempt to place 3D drawing buffer in system memory\n");
return 2;
case check_texture_addr0:
cur_seq->unfinished = tex_address;
tmp = (cmd >> 24);
tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
*tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
return 0;
case check_texture_addr1:
cur_seq->unfinished = tex_address;
tmp = ((cmd >> 24) - 0x20);
tmp += tmp << 1;
tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
tmp_addr++;
*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
tmp_addr++;
*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
return 0;
case check_texture_addr2:
cur_seq->unfinished = tex_address;
cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
return 0;
case check_texture_addr3:
cur_seq->unfinished = tex_address;
tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
if (tmp == 0 &&
(cmd & HC_HTXnEnPit_MASK)) {
cur_seq->pitch[cur_seq->texture][tmp] =
(cmd & HC_HTXnLnPit_MASK);
cur_seq->tex_npot[cur_seq->texture] = 1;
} else {
cur_seq->pitch[cur_seq->texture][tmp] =
(cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
cur_seq->tex_npot[cur_seq->texture] = 0;
if (cmd & 0x000FFFFF) {
DRM_ERROR
("Unimplemented texture level 0 pitch mode.\n");
return 2;
}
}
return 0;
case check_texture_addr4:
cur_seq->unfinished = tex_address;
tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
return 0;
case check_texture_addr5:
case check_texture_addr6:
cur_seq->unfinished = tex_address;
/*
* Texture width. We don't care since we have the pitch.
*/
return 0;
case check_texture_addr7:
cur_seq->unfinished = tex_address;
tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
tmp_addr[0] = 1 << (cmd & 0x0000000F);
return 0;
case check_texture_addr8:
cur_seq->unfinished = tex_address;
tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
tmp_addr[6] = 1 << (cmd & 0x0000000F);
return 0;
case check_texture_addr_mode:
cur_seq->unfinished = tex_address;
if (2 == (tmp = cmd & 0x00000003)) {
DRM_ERROR
("Attempt to fetch texture from system memory.\n");
return 2;
}
cur_seq->agp_texture = (tmp == 3);
cur_seq->tex_palette_size[cur_seq->texture] =
(cmd >> 16) & 0x000000007;
return 0;
case check_for_vertex_count:
cur_seq->vertex_count = cmd & 0x0000FFFF;
return 0;
case check_number_texunits:
cur_seq->multitex = (cmd >> 3) & 1;
return 0;
default:
DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
return 2;
}
return 2;
}
static __inline__ int
via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
drm_via_state_t * cur_seq)
{
drm_via_private_t *dev_priv =
(drm_via_private_t *) cur_seq->dev->dev_private;
uint32_t a_fire, bcmd, dw_count;
int ret = 0;
int have_fire;
const uint32_t *buf = *buffer;
while (buf < buf_end) {
have_fire = 0;
if ((buf_end - buf) < 2) {
DRM_ERROR
("Unexpected termination of primitive list.\n");
ret = 1;
break;
}
if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
break;
bcmd = *buf++;
if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
*buf);
ret = 1;
break;
}
a_fire =
*buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
HC_HE3Fire_MASK;
/*
* How many dwords per vertex ?
*/
if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
DRM_ERROR("Illegal B command vertex data for AGP.\n");
ret = 1;
break;
}
dw_count = 0;
if (bcmd & (1 << 7))
dw_count += (cur_seq->multitex) ? 2 : 1;
if (bcmd & (1 << 8))
dw_count += (cur_seq->multitex) ? 2 : 1;
if (bcmd & (1 << 9))
dw_count++;
if (bcmd & (1 << 10))
dw_count++;
if (bcmd & (1 << 11))
dw_count++;
if (bcmd & (1 << 12))
dw_count++;
if (bcmd & (1 << 13))
dw_count++;
if (bcmd & (1 << 14))
dw_count++;
while (buf < buf_end) {
if (*buf == a_fire) {
if (dev_priv->num_fire_offsets >=
VIA_FIRE_BUF_SIZE) {
DRM_ERROR("Fire offset buffer full.\n");
ret = 1;
break;
}
dev_priv->fire_offsets[dev_priv->
num_fire_offsets++] =
buf;
have_fire = 1;
buf++;
if (buf < buf_end && *buf == a_fire)
buf++;
break;
}
if ((*buf == HALCYON_HEADER2) ||
((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
DRM_ERROR("Missing Vertex Fire command, "
"Stray Vertex Fire command or verifier "
"lost sync.\n");
ret = 1;
break;
}
if ((ret = eat_words(&buf, buf_end, dw_count)))
break;
}
if (buf >= buf_end && !have_fire) {
DRM_ERROR("Missing Vertex Fire command or verifier "
"lost sync.\n");
ret = 1;
break;
}
if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
DRM_ERROR("AGP Primitive list end misaligned.\n");
ret = 1;
break;
}
}
*buffer = buf;
return ret;
}
static __inline__ verifier_state_t
via_check_header2(uint32_t const **buffer, const uint32_t * buf_end,
drm_via_state_t * hc_state)
{
uint32_t cmd;
int hz_mode;
hazard_t hz;
const uint32_t *buf = *buffer;
const hazard_t *hz_table;
if ((buf_end - buf) < 2) {
DRM_ERROR
("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
return state_error;
}
buf++;
cmd = (*buf++ & 0xFFFF0000) >> 16;
switch (cmd) {
case HC_ParaType_CmdVdata:
if (via_check_prim_list(&buf, buf_end, hc_state))
return state_error;
*buffer = buf;
return state_command;
case HC_ParaType_NotTex:
hz_table = table1;
break;
case HC_ParaType_Tex:
hc_state->texture = 0;
hz_table = table2;
break;
case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
hc_state->texture = 1;
hz_table = table2;
break;
case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
hz_table = table3;
break;
case HC_ParaType_Auto:
if (eat_words(&buf, buf_end, 2))
return state_error;
*buffer = buf;
return state_command;
case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
if (eat_words(&buf, buf_end, 32))
return state_error;
*buffer = buf;
return state_command;
case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
DRM_ERROR("Texture palettes are rejected because of "
"lack of info how to determine their size.\n");
return state_error;
case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
DRM_ERROR("Fog factor palettes are rejected because of "
"lack of info how to determine their size.\n");
return state_error;
default:
/*
* There are some unimplemented HC_ParaTypes here, that
* need to be implemented if the Mesa driver is extended.
*/
DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
"DMA subcommand: 0x%x. Previous dword: 0x%x\n",
cmd, *(buf - 2));
*buffer = buf;
return state_error;
}
while (buf < buf_end) {
cmd = *buf++;
if ((hz = hz_table[cmd >> 24])) {
if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
if (hz_mode == 1) {
buf--;
break;
}
return state_error;
}
} else if (hc_state->unfinished &&
finish_current_sequence(hc_state)) {
return state_error;
}
}
if (hc_state->unfinished && finish_current_sequence(hc_state)) {
return state_error;
}
*buffer = buf;
return state_command;
}
static __inline__ verifier_state_t
via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer,
const uint32_t * buf_end, int *fire_count)
{
uint32_t cmd;
const uint32_t *buf = *buffer;
const uint32_t *next_fire;
int burst = 0;
next_fire = dev_priv->fire_offsets[*fire_count];
buf++;
cmd = (*buf & 0xFFFF0000) >> 16;
VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
switch (cmd) {
case HC_ParaType_CmdVdata:
while ((buf < buf_end) &&
(*fire_count < dev_priv->num_fire_offsets) &&
(*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
while (buf <= next_fire) {
VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
(burst & 63), *buf++);
burst += 4;
}
if ((buf < buf_end)
&& ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
buf++;
if (++(*fire_count) < dev_priv->num_fire_offsets)
next_fire = dev_priv->fire_offsets[*fire_count];
}
break;
default:
while (buf < buf_end) {
if (*buf == HC_HEADER2 ||
(*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
(*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
(*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
break;
VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
(burst & 63), *buf++);
burst += 4;
}
}
*buffer = buf;
return state_command;
}
static __inline__ int verify_mmio_address(uint32_t address)
{
if ((address > 0x3FF) && (address < 0xC00)) {
DRM_ERROR("Invalid VIDEO DMA command. "
"Attempt to access 3D- or command burst area.\n");
return 1;
} else if ((address > 0xCFF) && (address < 0x1300)) {
DRM_ERROR("Invalid VIDEO DMA command. "
"Attempt to access PCI DMA area.\n");
return 1;
} else if (address > 0x13FF) {
DRM_ERROR("Invalid VIDEO DMA command. "
"Attempt to access VGA registers.\n");
return 1;
}
return 0;
}
static __inline__ int
verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
uint32_t dwords)
{
const uint32_t *buf = *buffer;
if (buf_end - buf < dwords) {
DRM_ERROR("Illegal termination of video command.\n");
return 1;
}
while (dwords--) {
if (*buf++) {
DRM_ERROR("Illegal video command tail.\n");
return 1;
}
}
*buffer = buf;
return 0;
}
static __inline__ verifier_state_t
via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
{
uint32_t cmd;
const uint32_t *buf = *buffer;
verifier_state_t ret = state_command;
while (buf < buf_end) {
cmd = *buf;
if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
(cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
break;
DRM_ERROR("Invalid HALCYON_HEADER1 command. "
"Attempt to access 3D- or command burst area.\n");
ret = state_error;
break;
} else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
break;
DRM_ERROR("Invalid HALCYON_HEADER1 command. "
"Attempt to access VGA registers.\n");
ret = state_error;
break;
} else {
buf += 2;
}
}
*buffer = buf;
return ret;
}
static __inline__ verifier_state_t
via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer,
const uint32_t * buf_end)
{
register uint32_t cmd;
const uint32_t *buf = *buffer;
while (buf < buf_end) {
cmd = *buf;
if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
break;
VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
buf++;
}
*buffer = buf;
return state_command;
}
static __inline__ verifier_state_t
via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end)
{
uint32_t data;
const uint32_t *buf = *buffer;
if (buf_end - buf < 4) {
DRM_ERROR("Illegal termination of video header5 command\n");
return state_error;
}
data = *buf++ & ~VIA_VIDEOMASK;
if (verify_mmio_address(data))
return state_error;
data = *buf++;
if (*buf++ != 0x00F50000) {
DRM_ERROR("Illegal header5 header data\n");
return state_error;
}
if (*buf++ != 0x00000000) {
DRM_ERROR("Illegal header5 header data\n");
return state_error;
}
if (eat_words(&buf, buf_end, data))
return state_error;
if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
return state_error;
*buffer = buf;
return state_command;
}
static __inline__ verifier_state_t
via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer,
const uint32_t * buf_end)
{
uint32_t addr, count, i;
const uint32_t *buf = *buffer;
addr = *buf++ & ~VIA_VIDEOMASK;
i = count = *buf;
buf += 3;
while (i--) {
VIA_WRITE(addr, *buf++);
}
if (count & 3)
buf += 4 - (count & 3);
*buffer = buf;
return state_command;
}
static __inline__ verifier_state_t
via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
{
uint32_t data;
const uint32_t *buf = *buffer;
uint32_t i;
if (buf_end - buf < 4) {
DRM_ERROR("Illegal termination of video header6 command\n");
return state_error;
}
buf++;
data = *buf++;
if (*buf++ != 0x00F60000) {
DRM_ERROR("Illegal header6 header data\n");
return state_error;
}
if (*buf++ != 0x00000000) {
DRM_ERROR("Illegal header6 header data\n");
return state_error;
}
if ((buf_end - buf) < (data << 1)) {
DRM_ERROR("Illegal termination of video header6 command\n");
return state_error;
}
for (i = 0; i < data; ++i) {
if (verify_mmio_address(*buf++))
return state_error;
buf++;
}
data <<= 1;
if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
return state_error;
*buffer = buf;
return state_command;
}
static __inline__ verifier_state_t
via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer,
const uint32_t * buf_end)
{
uint32_t addr, count, i;
const uint32_t *buf = *buffer;
i = count = *++buf;
buf += 3;
while (i--) {
addr = *buf++;
VIA_WRITE(addr, *buf++);
}
count <<= 1;
if (count & 3)
buf += 4 - (count & 3);
*buffer = buf;
return state_command;
}
int
via_verify_command_stream(const uint32_t * buf, unsigned int size,
struct drm_device * dev, int agp)
{
drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
drm_via_state_t *hc_state = &dev_priv->hc_state;
drm_via_state_t saved_state = *hc_state;
uint32_t cmd;
const uint32_t *buf_end = buf + (size >> 2);
verifier_state_t state = state_command;
int cme_video;
int supported_3d;
cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
dev_priv->chipset == VIA_DX9_0);
supported_3d = dev_priv->chipset != VIA_DX9_0;
hc_state->dev = dev;
hc_state->unfinished = no_sequence;
hc_state->map_cache = NULL;
hc_state->agp = agp;
hc_state->buf_start = buf;
dev_priv->num_fire_offsets = 0;
while (buf < buf_end) {
switch (state) {
case state_header2:
state = via_check_header2(&buf, buf_end, hc_state);
break;
case state_header1:
state = via_check_header1(&buf, buf_end);
break;
case state_vheader5:
state = via_check_vheader5(&buf, buf_end);
break;
case state_vheader6:
state = via_check_vheader6(&buf, buf_end);
break;
case state_command:
if ((HALCYON_HEADER2 == (cmd = *buf)) &&
supported_3d)
state = state_header2;
else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
state = state_header1;
else if (cme_video
&& (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
state = state_vheader5;
else if (cme_video
&& (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
state = state_vheader6;
else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
state = state_error;
} else {
DRM_ERROR
("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
cmd);
state = state_error;
}
break;
case state_error:
default:
*hc_state = saved_state;
return -EINVAL;
}
}
if (state == state_error) {
*hc_state = saved_state;
return -EINVAL;
}
return 0;
}
int
via_parse_command_stream(struct drm_device * dev, const uint32_t * buf,
unsigned int size)
{
drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
uint32_t cmd;
const uint32_t *buf_end = buf + (size >> 2);
verifier_state_t state = state_command;
int fire_count = 0;
while (buf < buf_end) {
switch (state) {
case state_header2:
state =
via_parse_header2(dev_priv, &buf, buf_end,
&fire_count);
break;
case state_header1:
state = via_parse_header1(dev_priv, &buf, buf_end);
break;
case state_vheader5:
state = via_parse_vheader5(dev_priv, &buf, buf_end);
break;
case state_vheader6:
state = via_parse_vheader6(dev_priv, &buf, buf_end);
break;
case state_command:
if (HALCYON_HEADER2 == (cmd = *buf))
state = state_header2;
else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
state = state_header1;
else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
state = state_vheader5;
else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
state = state_vheader6;
else {
DRM_ERROR
("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
cmd);
state = state_error;
}
break;
case state_error:
default:
return -EINVAL;
}
}
if (state == state_error) {
return -EINVAL;
}
return 0;
}
static void
setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
{
int i;
for (i = 0; i < 256; ++i) {
table[i] = forbidden_command;
}
for (i = 0; i < size; ++i) {
table[init_table[i].code] = init_table[i].hz;
}
}
void via_init_command_verifier(void)
{
setup_hazard_table(init_table1, table1,
sizeof(init_table1) / sizeof(hz_init_t));
setup_hazard_table(init_table2, table2,
sizeof(init_table2) / sizeof(hz_init_t));
setup_hazard_table(init_table3, table3,
sizeof(init_table3) / sizeof(hz_init_t));
}
View Git Blame Copy Permalink