Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
via_verifier.c
Go to the documentation of this file.
1 /*
2  * Copyright 2004 The Unichrome Project. All Rights Reserved.
3  * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4  *
5  * Permission is hereby granted, free of charge, to any person obtaining a
6  * copy of this software and associated documentation files (the "Software"),
7  * to deal in the Software without restriction, including without limitation
8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
9  * and/or sell copies of the Software, and to permit persons to whom the
10  * Software is furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice (including the
13  * next paragraph) shall be included in all copies or substantial portions
14  * of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22  * DEALINGS IN THE SOFTWARE.
23  *
24  * Author: Thomas Hellstrom 2004, 2005.
25  * This code was written using docs obtained under NDA from VIA Inc.
26  *
27  * Don't run this code directly on an AGP buffer. Due to cache problems it will
28  * be very slow.
29  */
30 
31 #include "via_3d_reg.h"
32 #include <drm/drmP.h>
33 #include <drm/via_drm.h>
34 #include "via_verifier.h"
35 #include "via_drv.h"
36 
37 typedef enum {
45 
46 typedef enum {
47  no_check = 0,
74 } hazard_t;
75 
76 /*
77  * Associates each hazard above with a possible multi-command
78  * sequence. For example an address that is split over multiple
79  * commands and that needs to be checked at the first command
80  * that does not include any part of the address.
81  */
82 
83 static drm_via_sequence_t seqs[] = {
90  z_address,
91  z_address,
92  z_address,
100  tex_address,
101  tex_address,
102  tex_address,
103  tex_address,
104  tex_address,
105  tex_address,
106  tex_address,
107  tex_address,
108  no_sequence
109 };
110 
111 typedef struct {
112  unsigned int code;
114 } hz_init_t;
115 
116 static hz_init_t init_table1[] = {
117  {0xf2, check_for_header2_err},
118  {0xf0, check_for_header1_err},
119  {0xee, check_for_fire},
120  {0xcc, check_for_dummy},
121  {0xdd, check_for_dd},
122  {0x00, no_check},
123  {0x10, check_z_buffer_addr0},
124  {0x11, check_z_buffer_addr1},
125  {0x12, check_z_buffer_addr_mode},
126  {0x13, no_check},
127  {0x14, no_check},
128  {0x15, no_check},
129  {0x23, no_check},
130  {0x24, no_check},
131  {0x33, no_check},
132  {0x34, no_check},
133  {0x35, no_check},
134  {0x36, no_check},
135  {0x37, no_check},
136  {0x38, no_check},
137  {0x39, no_check},
138  {0x3A, no_check},
139  {0x3B, no_check},
140  {0x3C, no_check},
141  {0x3D, no_check},
142  {0x3E, no_check},
143  {0x40, check_destination_addr0},
144  {0x41, check_destination_addr1},
146  {0x43, no_check},
147  {0x44, no_check},
148  {0x50, no_check},
149  {0x51, no_check},
150  {0x52, no_check},
151  {0x53, no_check},
152  {0x54, no_check},
153  {0x55, no_check},
154  {0x56, no_check},
155  {0x57, no_check},
156  {0x58, no_check},
157  {0x70, no_check},
158  {0x71, no_check},
159  {0x78, no_check},
160  {0x79, no_check},
161  {0x7A, no_check},
162  {0x7B, no_check},
163  {0x7C, no_check},
164  {0x7D, check_for_vertex_count}
165 };
166 
167 static hz_init_t init_table2[] = {
168  {0xf2, check_for_header2_err},
169  {0xf0, check_for_header1_err},
170  {0xee, check_for_fire},
171  {0xcc, check_for_dummy},
172  {0x00, check_texture_addr0},
173  {0x01, check_texture_addr0},
174  {0x02, check_texture_addr0},
175  {0x03, check_texture_addr0},
176  {0x04, check_texture_addr0},
177  {0x05, check_texture_addr0},
178  {0x06, check_texture_addr0},
179  {0x07, check_texture_addr0},
180  {0x08, check_texture_addr0},
181  {0x09, check_texture_addr0},
182  {0x20, check_texture_addr1},
183  {0x21, check_texture_addr1},
184  {0x22, check_texture_addr1},
185  {0x23, check_texture_addr4},
186  {0x2B, check_texture_addr3},
187  {0x2C, check_texture_addr3},
188  {0x2D, check_texture_addr3},
189  {0x2E, check_texture_addr3},
190  {0x2F, check_texture_addr3},
191  {0x30, check_texture_addr3},
192  {0x31, check_texture_addr3},
193  {0x32, check_texture_addr3},
194  {0x33, check_texture_addr3},
195  {0x34, check_texture_addr3},
196  {0x4B, check_texture_addr5},
197  {0x4C, check_texture_addr6},
198  {0x51, check_texture_addr7},
199  {0x52, check_texture_addr8},
200  {0x77, check_texture_addr2},
201  {0x78, no_check},
202  {0x79, no_check},
203  {0x7A, no_check},
204  {0x7B, check_texture_addr_mode},
205  {0x7C, no_check},
206  {0x7D, no_check},
207  {0x7E, no_check},
208  {0x7F, no_check},
209  {0x80, no_check},
210  {0x81, no_check},
211  {0x82, no_check},
212  {0x83, no_check},
213  {0x85, no_check},
214  {0x86, no_check},
215  {0x87, no_check},
216  {0x88, no_check},
217  {0x89, no_check},
218  {0x8A, no_check},
219  {0x90, no_check},
220  {0x91, no_check},
221  {0x92, no_check},
222  {0x93, no_check}
223 };
224 
225 static hz_init_t init_table3[] = {
226  {0xf2, check_for_header2_err},
227  {0xf0, check_for_header1_err},
228  {0xcc, check_for_dummy},
229  {0x00, check_number_texunits}
230 };
231 
232 static hazard_t table1[256];
233 static hazard_t table2[256];
234 static hazard_t table3[256];
235 
236 static __inline__ int
237 eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
238 {
239  if ((buf_end - *buf) >= num_words) {
240  *buf += num_words;
241  return 0;
242  }
243  DRM_ERROR("Illegal termination of DMA command buffer\n");
244  return 1;
245 }
246 
247 /*
248  * Partially stolen from drm_memory.h
249  */
250 
251 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
252  unsigned long offset,
253  unsigned long size,
254  struct drm_device *dev)
255 {
256  struct drm_map_list *r_list;
257  drm_local_map_t *map = seq->map_cache;
258 
259  if (map && map->offset <= offset
260  && (offset + size) <= (map->offset + map->size)) {
261  return map;
262  }
263 
264  list_for_each_entry(r_list, &dev->maplist, head) {
265  map = r_list->map;
266  if (!map)
267  continue;
268  if (map->offset <= offset
269  && (offset + size) <= (map->offset + map->size)
270  && !(map->flags & _DRM_RESTRICTED)
271  && (map->type == _DRM_AGP)) {
272  seq->map_cache = map;
273  return map;
274  }
275  }
276  return NULL;
277 }
278 
279 /*
280  * Require that all AGP texture levels reside in the same AGP map which should
281  * be mappable by the client. This is not a big restriction.
282  * FIXME: To actually enforce this security policy strictly, drm_rmmap
283  * would have to wait for dma quiescent before removing an AGP map.
284  * The via_drm_lookup_agp_map call in reality seems to take
285  * very little CPU time.
286  */
287 
288 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
289 {
290  switch (cur_seq->unfinished) {
291  case z_address:
292  DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
293  break;
294  case dest_address:
295  DRM_DEBUG("Destination start address is 0x%x\n",
296  cur_seq->d_addr);
297  break;
298  case tex_address:
299  if (cur_seq->agp_texture) {
300  unsigned start =
301  cur_seq->tex_level_lo[cur_seq->texture];
302  unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
303  unsigned long lo = ~0, hi = 0, tmp;
304  uint32_t *addr, *pitch, *height, tex;
305  unsigned i;
306  int npot;
307 
308  if (end > 9)
309  end = 9;
310  if (start > 9)
311  start = 9;
312 
313  addr =
314  &(cur_seq->t_addr[tex = cur_seq->texture][start]);
315  pitch = &(cur_seq->pitch[tex][start]);
316  height = &(cur_seq->height[tex][start]);
317  npot = cur_seq->tex_npot[tex];
318  for (i = start; i <= end; ++i) {
319  tmp = *addr++;
320  if (tmp < lo)
321  lo = tmp;
322  if (i == 0 && npot)
323  tmp += (*height++ * *pitch++);
324  else
325  tmp += (*height++ << *pitch++);
326  if (tmp > hi)
327  hi = tmp;
328  }
329 
330  if (!via_drm_lookup_agp_map
331  (cur_seq, lo, hi - lo, cur_seq->dev)) {
332  DRM_ERROR
333  ("AGP texture is not in allowed map\n");
334  return 2;
335  }
336  }
337  break;
338  default:
339  break;
340  }
341  cur_seq->unfinished = no_sequence;
342  return 0;
343 }
344 
345 static __inline__ int
346 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
347 {
348  register uint32_t tmp, *tmp_addr;
349 
350  if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
351  int ret;
352  if ((ret = finish_current_sequence(cur_seq)))
353  return ret;
354  }
355 
356  switch (hz) {
357  case check_for_header2:
358  if (cmd == HALCYON_HEADER2)
359  return 1;
360  return 0;
361  case check_for_header1:
362  if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
363  return 1;
364  return 0;
366  if (cmd == HALCYON_HEADER2)
367  return 1;
368  DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
369  break;
371  if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
372  return 1;
373  DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
374  break;
375  case check_for_fire:
376  if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
377  return 1;
378  DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
379  break;
380  case check_for_dummy:
381  if (HC_DUMMY == cmd)
382  return 0;
383  DRM_ERROR("Illegal DMA HC_DUMMY command\n");
384  break;
385  case check_for_dd:
386  if (0xdddddddd == cmd)
387  return 0;
388  DRM_ERROR("Illegal DMA 0xdddddddd command\n");
389  break;
391  cur_seq->unfinished = z_address;
392  cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
393  (cmd & 0x00FFFFFF);
394  return 0;
396  cur_seq->unfinished = z_address;
397  cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
398  ((cmd & 0xFF) << 24);
399  return 0;
401  cur_seq->unfinished = z_address;
402  if ((cmd & 0x0000C000) == 0)
403  return 0;
404  DRM_ERROR("Attempt to place Z buffer in system memory\n");
405  return 2;
407  cur_seq->unfinished = dest_address;
408  cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
409  (cmd & 0x00FFFFFF);
410  return 0;
412  cur_seq->unfinished = dest_address;
413  cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
414  ((cmd & 0xFF) << 24);
415  return 0;
417  cur_seq->unfinished = dest_address;
418  if ((cmd & 0x0000C000) == 0)
419  return 0;
420  DRM_ERROR
421  ("Attempt to place 3D drawing buffer in system memory\n");
422  return 2;
423  case check_texture_addr0:
424  cur_seq->unfinished = tex_address;
425  tmp = (cmd >> 24);
426  tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
427  *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
428  return 0;
429  case check_texture_addr1:
430  cur_seq->unfinished = tex_address;
431  tmp = ((cmd >> 24) - 0x20);
432  tmp += tmp << 1;
433  tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
434  *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
435  tmp_addr++;
436  *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
437  tmp_addr++;
438  *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
439  return 0;
440  case check_texture_addr2:
441  cur_seq->unfinished = tex_address;
442  cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
443  cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
444  return 0;
445  case check_texture_addr3:
446  cur_seq->unfinished = tex_address;
447  tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
448  if (tmp == 0 &&
449  (cmd & HC_HTXnEnPit_MASK)) {
450  cur_seq->pitch[cur_seq->texture][tmp] =
451  (cmd & HC_HTXnLnPit_MASK);
452  cur_seq->tex_npot[cur_seq->texture] = 1;
453  } else {
454  cur_seq->pitch[cur_seq->texture][tmp] =
456  cur_seq->tex_npot[cur_seq->texture] = 0;
457  if (cmd & 0x000FFFFF) {
458  DRM_ERROR
459  ("Unimplemented texture level 0 pitch mode.\n");
460  return 2;
461  }
462  }
463  return 0;
464  case check_texture_addr4:
465  cur_seq->unfinished = tex_address;
466  tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
467  *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
468  return 0;
469  case check_texture_addr5:
470  case check_texture_addr6:
471  cur_seq->unfinished = tex_address;
472  /*
473  * Texture width. We don't care since we have the pitch.
474  */
475  return 0;
476  case check_texture_addr7:
477  cur_seq->unfinished = tex_address;
478  tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
479  tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
480  tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
481  tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
482  tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
483  tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
484  tmp_addr[0] = 1 << (cmd & 0x0000000F);
485  return 0;
486  case check_texture_addr8:
487  cur_seq->unfinished = tex_address;
488  tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
489  tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
490  tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
491  tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
492  tmp_addr[6] = 1 << (cmd & 0x0000000F);
493  return 0;
495  cur_seq->unfinished = tex_address;
496  if (2 == (tmp = cmd & 0x00000003)) {
497  DRM_ERROR
498  ("Attempt to fetch texture from system memory.\n");
499  return 2;
500  }
501  cur_seq->agp_texture = (tmp == 3);
502  cur_seq->tex_palette_size[cur_seq->texture] =
503  (cmd >> 16) & 0x000000007;
504  return 0;
506  cur_seq->vertex_count = cmd & 0x0000FFFF;
507  return 0;
509  cur_seq->multitex = (cmd >> 3) & 1;
510  return 0;
511  default:
512  DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
513  return 2;
514  }
515  return 2;
516 }
517 
518 static __inline__ int
519 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
520  drm_via_state_t *cur_seq)
521 {
523  (drm_via_private_t *) cur_seq->dev->dev_private;
524  uint32_t a_fire, bcmd, dw_count;
525  int ret = 0;
526  int have_fire;
527  const uint32_t *buf = *buffer;
528 
529  while (buf < buf_end) {
530  have_fire = 0;
531  if ((buf_end - buf) < 2) {
532  DRM_ERROR
533  ("Unexpected termination of primitive list.\n");
534  ret = 1;
535  break;
536  }
537  if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
538  break;
539  bcmd = *buf++;
540  if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
541  DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
542  *buf);
543  ret = 1;
544  break;
545  }
546  a_fire =
547  *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
549 
550  /*
551  * How many dwords per vertex ?
552  */
553 
554  if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
555  DRM_ERROR("Illegal B command vertex data for AGP.\n");
556  ret = 1;
557  break;
558  }
559 
560  dw_count = 0;
561  if (bcmd & (1 << 7))
562  dw_count += (cur_seq->multitex) ? 2 : 1;
563  if (bcmd & (1 << 8))
564  dw_count += (cur_seq->multitex) ? 2 : 1;
565  if (bcmd & (1 << 9))
566  dw_count++;
567  if (bcmd & (1 << 10))
568  dw_count++;
569  if (bcmd & (1 << 11))
570  dw_count++;
571  if (bcmd & (1 << 12))
572  dw_count++;
573  if (bcmd & (1 << 13))
574  dw_count++;
575  if (bcmd & (1 << 14))
576  dw_count++;
577 
578  while (buf < buf_end) {
579  if (*buf == a_fire) {
580  if (dev_priv->num_fire_offsets >=
582  DRM_ERROR("Fire offset buffer full.\n");
583  ret = 1;
584  break;
585  }
586  dev_priv->fire_offsets[dev_priv->
587  num_fire_offsets++] =
588  buf;
589  have_fire = 1;
590  buf++;
591  if (buf < buf_end && *buf == a_fire)
592  buf++;
593  break;
594  }
595  if ((*buf == HALCYON_HEADER2) ||
596  ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
597  DRM_ERROR("Missing Vertex Fire command, "
598  "Stray Vertex Fire command or verifier "
599  "lost sync.\n");
600  ret = 1;
601  break;
602  }
603  if ((ret = eat_words(&buf, buf_end, dw_count)))
604  break;
605  }
606  if (buf >= buf_end && !have_fire) {
607  DRM_ERROR("Missing Vertex Fire command or verifier "
608  "lost sync.\n");
609  ret = 1;
610  break;
611  }
612  if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
613  DRM_ERROR("AGP Primitive list end misaligned.\n");
614  ret = 1;
615  break;
616  }
617  }
618  *buffer = buf;
619  return ret;
620 }
621 
623 via_check_header2(uint32_t const **buffer, const uint32_t *buf_end,
624  drm_via_state_t *hc_state)
625 {
626  uint32_t cmd;
627  int hz_mode;
628  hazard_t hz;
629  const uint32_t *buf = *buffer;
630  const hazard_t *hz_table;
631 
632  if ((buf_end - buf) < 2) {
633  DRM_ERROR
634  ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
635  return state_error;
636  }
637  buf++;
638  cmd = (*buf++ & 0xFFFF0000) >> 16;
639 
640  switch (cmd) {
642  if (via_check_prim_list(&buf, buf_end, hc_state))
643  return state_error;
644  *buffer = buf;
645  return state_command;
646  case HC_ParaType_NotTex:
647  hz_table = table1;
648  break;
649  case HC_ParaType_Tex:
650  hc_state->texture = 0;
651  hz_table = table2;
652  break;
653  case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
654  hc_state->texture = 1;
655  hz_table = table2;
656  break;
657  case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
658  hz_table = table3;
659  break;
660  case HC_ParaType_Auto:
661  if (eat_words(&buf, buf_end, 2))
662  return state_error;
663  *buffer = buf;
664  return state_command;
665  case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
666  if (eat_words(&buf, buf_end, 32))
667  return state_error;
668  *buffer = buf;
669  return state_command;
672  DRM_ERROR("Texture palettes are rejected because of "
673  "lack of info how to determine their size.\n");
674  return state_error;
676  DRM_ERROR("Fog factor palettes are rejected because of "
677  "lack of info how to determine their size.\n");
678  return state_error;
679  default:
680 
681  /*
682  * There are some unimplemented HC_ParaTypes here, that
683  * need to be implemented if the Mesa driver is extended.
684  */
685 
686  DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
687  "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
688  cmd, *(buf - 2));
689  *buffer = buf;
690  return state_error;
691  }
692 
693  while (buf < buf_end) {
694  cmd = *buf++;
695  if ((hz = hz_table[cmd >> 24])) {
696  if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
697  if (hz_mode == 1) {
698  buf--;
699  break;
700  }
701  return state_error;
702  }
703  } else if (hc_state->unfinished &&
704  finish_current_sequence(hc_state)) {
705  return state_error;
706  }
707  }
708  if (hc_state->unfinished && finish_current_sequence(hc_state))
709  return state_error;
710  *buffer = buf;
711  return state_command;
712 }
713 
715 via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer,
716  const uint32_t *buf_end, int *fire_count)
717 {
718  uint32_t cmd;
719  const uint32_t *buf = *buffer;
720  const uint32_t *next_fire;
721  int burst = 0;
722 
723  next_fire = dev_priv->fire_offsets[*fire_count];
724  buf++;
725  cmd = (*buf & 0xFFFF0000) >> 16;
727  switch (cmd) {
729  while ((buf < buf_end) &&
730  (*fire_count < dev_priv->num_fire_offsets) &&
731  (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
732  while (buf <= next_fire) {
734  (burst & 63), *buf++);
735  burst += 4;
736  }
737  if ((buf < buf_end)
738  && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
739  buf++;
740 
741  if (++(*fire_count) < dev_priv->num_fire_offsets)
742  next_fire = dev_priv->fire_offsets[*fire_count];
743  }
744  break;
745  default:
746  while (buf < buf_end) {
747 
748  if (*buf == HC_HEADER2 ||
749  (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
750  (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
751  (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
752  break;
753 
755  (burst & 63), *buf++);
756  burst += 4;
757  }
758  }
759  *buffer = buf;
760  return state_command;
761 }
762 
763 static __inline__ int verify_mmio_address(uint32_t address)
764 {
765  if ((address > 0x3FF) && (address < 0xC00)) {
766  DRM_ERROR("Invalid VIDEO DMA command. "
767  "Attempt to access 3D- or command burst area.\n");
768  return 1;
769  } else if ((address > 0xCFF) && (address < 0x1300)) {
770  DRM_ERROR("Invalid VIDEO DMA command. "
771  "Attempt to access PCI DMA area.\n");
772  return 1;
773  } else if (address > 0x13FF) {
774  DRM_ERROR("Invalid VIDEO DMA command. "
775  "Attempt to access VGA registers.\n");
776  return 1;
777  }
778  return 0;
779 }
780 
781 static __inline__ int
782 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
783  uint32_t dwords)
784 {
785  const uint32_t *buf = *buffer;
786 
787  if (buf_end - buf < dwords) {
788  DRM_ERROR("Illegal termination of video command.\n");
789  return 1;
790  }
791  while (dwords--) {
792  if (*buf++) {
793  DRM_ERROR("Illegal video command tail.\n");
794  return 1;
795  }
796  }
797  *buffer = buf;
798  return 0;
799 }
800 
802 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
803 {
804  uint32_t cmd;
805  const uint32_t *buf = *buffer;
807 
808  while (buf < buf_end) {
809  cmd = *buf;
810  if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
811  (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
812  if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
813  break;
814  DRM_ERROR("Invalid HALCYON_HEADER1 command. "
815  "Attempt to access 3D- or command burst area.\n");
816  ret = state_error;
817  break;
818  } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
819  if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
820  break;
821  DRM_ERROR("Invalid HALCYON_HEADER1 command. "
822  "Attempt to access VGA registers.\n");
823  ret = state_error;
824  break;
825  } else {
826  buf += 2;
827  }
828  }
829  *buffer = buf;
830  return ret;
831 }
832 
834 via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer,
835  const uint32_t *buf_end)
836 {
837  register uint32_t cmd;
838  const uint32_t *buf = *buffer;
839 
840  while (buf < buf_end) {
841  cmd = *buf;
842  if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
843  break;
844  VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
845  buf++;
846  }
847  *buffer = buf;
848  return state_command;
849 }
850 
852 via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end)
853 {
854  uint32_t data;
855  const uint32_t *buf = *buffer;
856 
857  if (buf_end - buf < 4) {
858  DRM_ERROR("Illegal termination of video header5 command\n");
859  return state_error;
860  }
861 
862  data = *buf++ & ~VIA_VIDEOMASK;
863  if (verify_mmio_address(data))
864  return state_error;
865 
866  data = *buf++;
867  if (*buf++ != 0x00F50000) {
868  DRM_ERROR("Illegal header5 header data\n");
869  return state_error;
870  }
871  if (*buf++ != 0x00000000) {
872  DRM_ERROR("Illegal header5 header data\n");
873  return state_error;
874  }
875  if (eat_words(&buf, buf_end, data))
876  return state_error;
877  if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
878  return state_error;
879  *buffer = buf;
880  return state_command;
881 
882 }
883 
885 via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer,
886  const uint32_t *buf_end)
887 {
888  uint32_t addr, count, i;
889  const uint32_t *buf = *buffer;
890 
891  addr = *buf++ & ~VIA_VIDEOMASK;
892  i = count = *buf;
893  buf += 3;
894  while (i--)
895  VIA_WRITE(addr, *buf++);
896  if (count & 3)
897  buf += 4 - (count & 3);
898  *buffer = buf;
899  return state_command;
900 }
901 
903 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
904 {
905  uint32_t data;
906  const uint32_t *buf = *buffer;
907  uint32_t i;
908 
909  if (buf_end - buf < 4) {
910  DRM_ERROR("Illegal termination of video header6 command\n");
911  return state_error;
912  }
913  buf++;
914  data = *buf++;
915  if (*buf++ != 0x00F60000) {
916  DRM_ERROR("Illegal header6 header data\n");
917  return state_error;
918  }
919  if (*buf++ != 0x00000000) {
920  DRM_ERROR("Illegal header6 header data\n");
921  return state_error;
922  }
923  if ((buf_end - buf) < (data << 1)) {
924  DRM_ERROR("Illegal termination of video header6 command\n");
925  return state_error;
926  }
927  for (i = 0; i < data; ++i) {
928  if (verify_mmio_address(*buf++))
929  return state_error;
930  buf++;
931  }
932  data <<= 1;
933  if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
934  return state_error;
935  *buffer = buf;
936  return state_command;
937 }
938 
940 via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer,
941  const uint32_t *buf_end)
942 {
943 
944  uint32_t addr, count, i;
945  const uint32_t *buf = *buffer;
946 
947  i = count = *++buf;
948  buf += 3;
949  while (i--) {
950  addr = *buf++;
951  VIA_WRITE(addr, *buf++);
952  }
953  count <<= 1;
954  if (count & 3)
955  buf += 4 - (count & 3);
956  *buffer = buf;
957  return state_command;
958 }
959 
960 int
961 via_verify_command_stream(const uint32_t * buf, unsigned int size,
962  struct drm_device * dev, int agp)
963 {
964 
965  drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
966  drm_via_state_t *hc_state = &dev_priv->hc_state;
967  drm_via_state_t saved_state = *hc_state;
968  uint32_t cmd;
969  const uint32_t *buf_end = buf + (size >> 2);
971  int cme_video;
972  int supported_3d;
973 
974  cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
975  dev_priv->chipset == VIA_DX9_0);
976 
977  supported_3d = dev_priv->chipset != VIA_DX9_0;
978 
979  hc_state->dev = dev;
980  hc_state->unfinished = no_sequence;
981  hc_state->map_cache = NULL;
982  hc_state->agp = agp;
983  hc_state->buf_start = buf;
984  dev_priv->num_fire_offsets = 0;
985 
986  while (buf < buf_end) {
987 
988  switch (state) {
989  case state_header2:
990  state = via_check_header2(&buf, buf_end, hc_state);
991  break;
992  case state_header1:
993  state = via_check_header1(&buf, buf_end);
994  break;
995  case state_vheader5:
996  state = via_check_vheader5(&buf, buf_end);
997  break;
998  case state_vheader6:
999  state = via_check_vheader6(&buf, buf_end);
1000  break;
1001  case state_command:
1002  if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1003  supported_3d)
1004  state = state_header2;
1005  else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1006  state = state_header1;
1007  else if (cme_video
1008  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1009  state = state_vheader5;
1010  else if (cme_video
1011  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1012  state = state_vheader6;
1013  else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1014  DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1015  state = state_error;
1016  } else {
1017  DRM_ERROR
1018  ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1019  cmd);
1020  state = state_error;
1021  }
1022  break;
1023  case state_error:
1024  default:
1025  *hc_state = saved_state;
1026  return -EINVAL;
1027  }
1028  }
1029  if (state == state_error) {
1030  *hc_state = saved_state;
1031  return -EINVAL;
1032  }
1033  return 0;
1034 }
1035 
1036 int
1038  unsigned int size)
1039 {
1040 
1041  drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1042  uint32_t cmd;
1043  const uint32_t *buf_end = buf + (size >> 2);
1045  int fire_count = 0;
1046 
1047  while (buf < buf_end) {
1048 
1049  switch (state) {
1050  case state_header2:
1051  state =
1052  via_parse_header2(dev_priv, &buf, buf_end,
1053  &fire_count);
1054  break;
1055  case state_header1:
1056  state = via_parse_header1(dev_priv, &buf, buf_end);
1057  break;
1058  case state_vheader5:
1059  state = via_parse_vheader5(dev_priv, &buf, buf_end);
1060  break;
1061  case state_vheader6:
1062  state = via_parse_vheader6(dev_priv, &buf, buf_end);
1063  break;
1064  case state_command:
1065  if (HALCYON_HEADER2 == (cmd = *buf))
1066  state = state_header2;
1067  else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1068  state = state_header1;
1069  else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1070  state = state_vheader5;
1071  else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1072  state = state_vheader6;
1073  else {
1074  DRM_ERROR
1075  ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1076  cmd);
1077  state = state_error;
1078  }
1079  break;
1080  case state_error:
1081  default:
1082  return -EINVAL;
1083  }
1084  }
1085  if (state == state_error)
1086  return -EINVAL;
1087  return 0;
1088 }
1089 
1090 static void
1091 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1092 {
1093  int i;
1094 
1095  for (i = 0; i < 256; ++i)
1096  table[i] = forbidden_command;
1097 
1098  for (i = 0; i < size; ++i)
1099  table[init_table[i].code] = init_table[i].hz;
1100 }
1101 
1103 {
1104  setup_hazard_table(init_table1, table1,
1105  sizeof(init_table1) / sizeof(hz_init_t));
1106  setup_hazard_table(init_table2, table2,
1107  sizeof(init_table2) / sizeof(hz_init_t));
1108  setup_hazard_table(init_table3, table3,
1109  sizeof(init_table3) / sizeof(hz_init_t));
1110 }