?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add -Werror-implicit-function-declaration
[linux-2.6/verdex.git] / drivers / char / drm / via_verifier.c
blob2e7e080782874717d62ca38cb4ef2ae206d127ff
1 /*
2 * Copyright 2004 The Unichrome Project. All Rights Reserved.
3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sub license,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial portions
14 * of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 * DEALINGS IN THE SOFTWARE.
23 *
24 * Author: Thomas Hellstrom 2004, 2005.
25 * This code was written using docs obtained under NDA from VIA Inc.
26 *
27 * Don't run this code directly on an AGP buffer. Due to cache problems it will
28 * be very slow.
29 */
30
31 #include "via_3d_reg.h"
32 #include "drmP.h"
33 #include "drm.h"
34 #include "via_drm.h"
35 #include "via_verifier.h"
36 #include "via_drv.h"
37
38 typedef enum {
39 state_command,
40 state_header2,
41 state_header1,
42 state_vheader5,
43 state_vheader6,
44 state_error
45 } verifier_state_t;
46
47 typedef enum {
48 no_check = 0,
49 check_for_header2,
50 check_for_header1,
51 check_for_header2_err,
52 check_for_header1_err,
53 check_for_fire,
54 check_z_buffer_addr0,
55 check_z_buffer_addr1,
56 check_z_buffer_addr_mode,
57 check_destination_addr0,
58 check_destination_addr1,
59 check_destination_addr_mode,
60 check_for_dummy,
61 check_for_dd,
62 check_texture_addr0,
63 check_texture_addr1,
64 check_texture_addr2,
65 check_texture_addr3,
66 check_texture_addr4,
67 check_texture_addr5,
68 check_texture_addr6,
69 check_texture_addr7,
70 check_texture_addr8,
71 check_texture_addr_mode,
72 check_for_vertex_count,
73 check_number_texunits,
74 forbidden_command
75 } hazard_t;
76
77 /*
78 * Associates each hazard above with a possible multi-command
79 * sequence. For example an address that is split over multiple
80 * commands and that needs to be checked at the first command
81 * that does not include any part of the address.
82 */
83
84 static drm_via_sequence_t seqs[] = {
85 no_sequence,
86 no_sequence,
87 no_sequence,
88 no_sequence,
89 no_sequence,
90 no_sequence,
91 z_address,
92 z_address,
93 z_address,
94 dest_address,
95 dest_address,
96 dest_address,
97 no_sequence,
98 no_sequence,
99 tex_address,
100 tex_address,
101 tex_address,
102 tex_address,
103 tex_address,
104 tex_address,
105 tex_address,
106 tex_address,
107 tex_address,
108 tex_address,
109 no_sequence
110 };
111
112 typedef struct {
113 unsigned int code;
114 hazard_t hz;
115 } hz_init_t;
116
117 static hz_init_t init_table1[] = {
118 {0xf2, check_for_header2_err},
119 {0xf0, check_for_header1_err},
120 {0xee, check_for_fire},
121 {0xcc, check_for_dummy},
122 {0xdd, check_for_dd},
123 {0x00, no_check},
124 {0x10, check_z_buffer_addr0},
125 {0x11, check_z_buffer_addr1},
126 {0x12, check_z_buffer_addr_mode},
127 {0x13, no_check},
128 {0x14, no_check},
129 {0x15, no_check},
130 {0x23, no_check},
131 {0x24, no_check},
132 {0x33, no_check},
133 {0x34, no_check},
134 {0x35, no_check},
135 {0x36, no_check},
136 {0x37, no_check},
137 {0x38, no_check},
138 {0x39, no_check},
139 {0x3A, no_check},
140 {0x3B, no_check},
141 {0x3C, no_check},
142 {0x3D, no_check},
143 {0x3E, no_check},
144 {0x40, check_destination_addr0},
145 {0x41, check_destination_addr1},
146 {0x42, check_destination_addr_mode},
147 {0x43, no_check},
148 {0x44, no_check},
149 {0x50, no_check},
150 {0x51, no_check},
151 {0x52, no_check},
152 {0x53, no_check},
153 {0x54, no_check},
154 {0x55, no_check},
155 {0x56, no_check},
156 {0x57, no_check},
157 {0x58, no_check},
158 {0x70, no_check},
159 {0x71, no_check},
160 {0x78, no_check},
161 {0x79, no_check},
162 {0x7A, no_check},
163 {0x7B, no_check},
164 {0x7C, no_check},
165 {0x7D, check_for_vertex_count}
166 };
167
168 static hz_init_t init_table2[] = {
169 {0xf2, check_for_header2_err},
170 {0xf0, check_for_header1_err},
171 {0xee, check_for_fire},
172 {0xcc, check_for_dummy},
173 {0x00, check_texture_addr0},
174 {0x01, check_texture_addr0},
175 {0x02, check_texture_addr0},
176 {0x03, check_texture_addr0},
177 {0x04, check_texture_addr0},
178 {0x05, check_texture_addr0},
179 {0x06, check_texture_addr0},
180 {0x07, check_texture_addr0},
181 {0x08, check_texture_addr0},
182 {0x09, check_texture_addr0},
183 {0x20, check_texture_addr1},
184 {0x21, check_texture_addr1},
185 {0x22, check_texture_addr1},
186 {0x23, check_texture_addr4},
187 {0x2B, check_texture_addr3},
188 {0x2C, check_texture_addr3},
189 {0x2D, check_texture_addr3},
190 {0x2E, check_texture_addr3},
191 {0x2F, check_texture_addr3},
192 {0x30, check_texture_addr3},
193 {0x31, check_texture_addr3},
194 {0x32, check_texture_addr3},
195 {0x33, check_texture_addr3},
196 {0x34, check_texture_addr3},
197 {0x4B, check_texture_addr5},
198 {0x4C, check_texture_addr6},
199 {0x51, check_texture_addr7},
200 {0x52, check_texture_addr8},
201 {0x77, check_texture_addr2},
202 {0x78, no_check},
203 {0x79, no_check},
204 {0x7A, no_check},
205 {0x7B, check_texture_addr_mode},
206 {0x7C, no_check},
207 {0x7D, no_check},
208 {0x7E, no_check},
209 {0x7F, no_check},
210 {0x80, no_check},
211 {0x81, no_check},
212 {0x82, no_check},
213 {0x83, no_check},
214 {0x85, no_check},
215 {0x86, no_check},
216 {0x87, no_check},
217 {0x88, no_check},
218 {0x89, no_check},
219 {0x8A, no_check},
220 {0x90, no_check},
221 {0x91, no_check},
222 {0x92, no_check},
223 {0x93, no_check}
224 };
225
226 static hz_init_t init_table3[] = {
227 {0xf2, check_for_header2_err},
228 {0xf0, check_for_header1_err},
229 {0xcc, check_for_dummy},
230 {0x00, check_number_texunits}
231 };
232
233 static hazard_t table1[256];
234 static hazard_t table2[256];
235 static hazard_t table3[256];
236
237 static __inline__ int
238 eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
239 {
240 if ((buf_end - *buf) >= num_words) {
241 *buf += num_words;
242 return 0;
243 }
244 DRM_ERROR("Illegal termination of DMA command buffer\n");
245 return 1;
246 }
247
248 /*
249 * Partially stolen from drm_memory.h
250 */
251
252 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
253 unsigned long offset,
254 unsigned long size,
255 drm_device_t * dev)
256 {
257 struct list_head *list;
258 drm_map_list_t *r_list;
259 drm_local_map_t *map = seq->map_cache;
260
261 if (map && map->offset <= offset
262 && (offset + size) <= (map->offset + map->size)) {
263 return map;
264 }
265
266 list_for_each(list, &dev->maplist->head) {
267 r_list = (drm_map_list_t *) list;
268 map = r_list->map;
269 if (!map)
270 continue;
271 if (map->offset <= offset
272 && (offset + size) <= (map->offset + map->size)
273 && !(map->flags & _DRM_RESTRICTED)
274 && (map->type == _DRM_AGP)) {
275 seq->map_cache = map;
276 return map;
277 }
278 }
279 return NULL;
280 }
281
282 /*
283 * Require that all AGP texture levels reside in the same AGP map which should
284 * be mappable by the client. This is not a big restriction.
285 * FIXME: To actually enforce this security policy strictly, drm_rmmap
286 * would have to wait for dma quiescent before removing an AGP map.
287 * The via_drm_lookup_agp_map call in reality seems to take
288 * very little CPU time.
289 */
290
291 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
292 {
293 switch (cur_seq->unfinished) {
294 case z_address:
295 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
296 break;
297 case dest_address:
298 DRM_DEBUG("Destination start address is 0x%x\n",
299 cur_seq->d_addr);
300 break;
301 case tex_address:
302 if (cur_seq->agp_texture) {
303 unsigned start =
304 cur_seq->tex_level_lo[cur_seq->texture];
305 unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
306 unsigned long lo = ~0, hi = 0, tmp;
307 uint32_t *addr, *pitch, *height, tex;
308 unsigned i;
309 int npot;
310
311 if (end > 9)
312 end = 9;
313 if (start > 9)
314 start = 9;
315
316 addr =
317 &(cur_seq->t_addr[tex = cur_seq->texture][start]);
318 pitch = &(cur_seq->pitch[tex][start]);
319 height = &(cur_seq->height[tex][start]);
320 npot = cur_seq->tex_npot[tex];
321 for (i = start; i <= end; ++i) {
322 tmp = *addr++;
323 if (tmp < lo)
324 lo = tmp;
325 if (i == 0 && npot)
326 tmp += (*height++ * *pitch++);
327 else
328 tmp += (*height++ << *pitch++);
329 if (tmp > hi)
330 hi = tmp;
331 }
332
333 if (!via_drm_lookup_agp_map
334 (cur_seq, lo, hi - lo, cur_seq->dev)) {
335 DRM_ERROR
336 ("AGP texture is not in allowed map\n");
337 return 2;
338 }
339 }
340 break;
341 default:
342 break;
343 }
344 cur_seq->unfinished = no_sequence;
345 return 0;
346 }
347
348 static __inline__ int
349 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
350 {
351 register uint32_t tmp, *tmp_addr;
352
353 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
354 int ret;
355 if ((ret = finish_current_sequence(cur_seq)))
356 return ret;
357 }
358
359 switch (hz) {
360 case check_for_header2:
361 if (cmd == HALCYON_HEADER2)
362 return 1;
363 return 0;
364 case check_for_header1:
365 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
366 return 1;
367 return 0;
368 case check_for_header2_err:
369 if (cmd == HALCYON_HEADER2)
370 return 1;
371 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
372 break;
373 case check_for_header1_err:
374 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
375 return 1;
376 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
377 break;
378 case check_for_fire:
379 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
380 return 1;
381 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
382 break;
383 case check_for_dummy:
384 if (HC_DUMMY == cmd)
385 return 0;
386 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
387 break;
388 case check_for_dd:
389 if (0xdddddddd == cmd)
390 return 0;
391 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
392 break;
393 case check_z_buffer_addr0:
394 cur_seq->unfinished = z_address;
395 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
396 (cmd & 0x00FFFFFF);
397 return 0;
398 case check_z_buffer_addr1:
399 cur_seq->unfinished = z_address;
400 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
401 ((cmd & 0xFF) << 24);
402 return 0;
403 case check_z_buffer_addr_mode:
404 cur_seq->unfinished = z_address;
405 if ((cmd & 0x0000C000) == 0)
406 return 0;
407 DRM_ERROR("Attempt to place Z buffer in system memory\n");
408 return 2;
409 case check_destination_addr0:
410 cur_seq->unfinished = dest_address;
411 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
412 (cmd & 0x00FFFFFF);
413 return 0;
414 case check_destination_addr1:
415 cur_seq->unfinished = dest_address;
416 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
417 ((cmd & 0xFF) << 24);
418 return 0;
419 case check_destination_addr_mode:
420 cur_seq->unfinished = dest_address;
421 if ((cmd & 0x0000C000) == 0)
422 return 0;
423 DRM_ERROR
424 ("Attempt to place 3D drawing buffer in system memory\n");
425 return 2;
426 case check_texture_addr0:
427 cur_seq->unfinished = tex_address;
428 tmp = (cmd >> 24);
429 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
430 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
431 return 0;
432 case check_texture_addr1:
433 cur_seq->unfinished = tex_address;
434 tmp = ((cmd >> 24) - 0x20);
435 tmp += tmp << 1;
436 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
437 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
438 tmp_addr++;
439 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
440 tmp_addr++;
441 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
442 return 0;
443 case check_texture_addr2:
444 cur_seq->unfinished = tex_address;
445 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
446 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
447 return 0;
448 case check_texture_addr3:
449 cur_seq->unfinished = tex_address;
450 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
451 if (tmp == 0 &&
452 (cmd & HC_HTXnEnPit_MASK)) {
453 cur_seq->pitch[cur_seq->texture][tmp] =
454 (cmd & HC_HTXnLnPit_MASK);
455 cur_seq->tex_npot[cur_seq->texture] = 1;
456 } else {
457 cur_seq->pitch[cur_seq->texture][tmp] =
458 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
459 cur_seq->tex_npot[cur_seq->texture] = 0;
460 if (cmd & 0x000FFFFF) {
461 DRM_ERROR
462 ("Unimplemented texture level 0 pitch mode.\n");
463 return 2;
464 }
465 }
466 return 0;
467 case check_texture_addr4:
468 cur_seq->unfinished = tex_address;
469 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
470 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
471 return 0;
472 case check_texture_addr5:
473 case check_texture_addr6:
474 cur_seq->unfinished = tex_address;
475 /*
476 * Texture width. We don't care since we have the pitch.
477 */
478 return 0;
479 case check_texture_addr7:
480 cur_seq->unfinished = tex_address;
481 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
482 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
483 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
484 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
485 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
486 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
487 tmp_addr[0] = 1 << (cmd & 0x0000000F);
488 return 0;
489 case check_texture_addr8:
490 cur_seq->unfinished = tex_address;
491 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
492 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
493 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
494 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
495 tmp_addr[6] = 1 << (cmd & 0x0000000F);
496 return 0;
497 case check_texture_addr_mode:
498 cur_seq->unfinished = tex_address;
499 if (2 == (tmp = cmd & 0x00000003)) {
500 DRM_ERROR
501 ("Attempt to fetch texture from system memory.\n");
502 return 2;
503 }
504 cur_seq->agp_texture = (tmp == 3);
505 cur_seq->tex_palette_size[cur_seq->texture] =
506 (cmd >> 16) & 0x000000007;
507 return 0;
508 case check_for_vertex_count:
509 cur_seq->vertex_count = cmd & 0x0000FFFF;
510 return 0;
511 case check_number_texunits:
512 cur_seq->multitex = (cmd >> 3) & 1;
513 return 0;
514 default:
515 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
516 return 2;
517 }
518 return 2;
519 }
520
521 static __inline__ int
522 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
523 drm_via_state_t * cur_seq)
524 {
525 drm_via_private_t *dev_priv =
526 (drm_via_private_t *) cur_seq->dev->dev_private;
527 uint32_t a_fire, bcmd, dw_count;
528 int ret = 0;
529 int have_fire;
530 const uint32_t *buf = *buffer;
531
532 while (buf < buf_end) {
533 have_fire = 0;
534 if ((buf_end - buf) < 2) {
535 DRM_ERROR
536 ("Unexpected termination of primitive list.\n");
537 ret = 1;
538 break;
539 }
540 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
541 break;
542 bcmd = *buf++;
543 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
544 DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
545 *buf);
546 ret = 1;
547 break;
548 }
549 a_fire =
550 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
551 HC_HE3Fire_MASK;
552
553 /*
554 * How many dwords per vertex ?
555 */
556
557 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
558 DRM_ERROR("Illegal B command vertex data for AGP.\n");
559 ret = 1;
560 break;
561 }
562
563 dw_count = 0;
564 if (bcmd & (1 << 7))
565 dw_count += (cur_seq->multitex) ? 2 : 1;
566 if (bcmd & (1 << 8))
567 dw_count += (cur_seq->multitex) ? 2 : 1;
568 if (bcmd & (1 << 9))
569 dw_count++;
570 if (bcmd & (1 << 10))
571 dw_count++;
572 if (bcmd & (1 << 11))
573 dw_count++;
574 if (bcmd & (1 << 12))
575 dw_count++;
576 if (bcmd & (1 << 13))
577 dw_count++;
578 if (bcmd & (1 << 14))
579 dw_count++;
580
581 while (buf < buf_end) {
582 if (*buf == a_fire) {
583 if (dev_priv->num_fire_offsets >=
584 VIA_FIRE_BUF_SIZE) {
585 DRM_ERROR("Fire offset buffer full.\n");
586 ret = 1;
587 break;
588 }
589 dev_priv->fire_offsets[dev_priv->
590 num_fire_offsets++] =
591 buf;
592 have_fire = 1;
593 buf++;
594 if (buf < buf_end && *buf == a_fire)
595 buf++;
596 break;
597 }
598 if ((*buf == HALCYON_HEADER2) ||
599 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
600 DRM_ERROR("Missing Vertex Fire command, "
601 "Stray Vertex Fire command or verifier "
602 "lost sync.\n");
603 ret = 1;
604 break;
605 }
606 if ((ret = eat_words(&buf, buf_end, dw_count)))
607 break;
608 }
609 if (buf >= buf_end && !have_fire) {
610 DRM_ERROR("Missing Vertex Fire command or verifier "
611 "lost sync.\n");
612 ret = 1;
613 break;
614 }
615 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
616 DRM_ERROR("AGP Primitive list end misaligned.\n");
617 ret = 1;
618 break;
619 }
620 }
621 *buffer = buf;
622 return ret;
623 }
624
625 static __inline__ verifier_state_t
626 via_check_header2(uint32_t const **buffer, const uint32_t * buf_end,
627 drm_via_state_t * hc_state)
628 {
629 uint32_t cmd;
630 int hz_mode;
631 hazard_t hz;
632 const uint32_t *buf = *buffer;
633 const hazard_t *hz_table;
634
635 if ((buf_end - buf) < 2) {
636 DRM_ERROR
637 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
638 return state_error;
639 }
640 buf++;
641 cmd = (*buf++ & 0xFFFF0000) >> 16;
642
643 switch (cmd) {
644 case HC_ParaType_CmdVdata:
645 if (via_check_prim_list(&buf, buf_end, hc_state))
646 return state_error;
647 *buffer = buf;
648 return state_command;
649 case HC_ParaType_NotTex:
650 hz_table = table1;
651 break;
652 case HC_ParaType_Tex:
653 hc_state->texture = 0;
654 hz_table = table2;
655 break;
656 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
657 hc_state->texture = 1;
658 hz_table = table2;
659 break;
660 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
661 hz_table = table3;
662 break;
663 case HC_ParaType_Auto:
664 if (eat_words(&buf, buf_end, 2))
665 return state_error;
666 *buffer = buf;
667 return state_command;
668 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
669 if (eat_words(&buf, buf_end, 32))
670 return state_error;
671 *buffer = buf;
672 return state_command;
673 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
674 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
675 DRM_ERROR("Texture palettes are rejected because of "
676 "lack of info how to determine their size.\n");
677 return state_error;
678 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
679 DRM_ERROR("Fog factor palettes are rejected because of "
680 "lack of info how to determine their size.\n");
681 return state_error;
682 default:
683
684 /*
685 * There are some unimplemented HC_ParaTypes here, that
686 * need to be implemented if the Mesa driver is extended.
687 */
688
689 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
690 "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
691 cmd, *(buf - 2));
692 *buffer = buf;
693 return state_error;
694 }
695
696 while (buf < buf_end) {
697 cmd = *buf++;
698 if ((hz = hz_table[cmd >> 24])) {
699 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
700 if (hz_mode == 1) {
701 buf--;
702 break;
703 }
704 return state_error;
705 }
706 } else if (hc_state->unfinished &&
707 finish_current_sequence(hc_state)) {
708 return state_error;
709 }
710 }
711 if (hc_state->unfinished && finish_current_sequence(hc_state)) {
712 return state_error;
713 }
714 *buffer = buf;
715 return state_command;
716 }
717
718 static __inline__ verifier_state_t
719 via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer,
720 const uint32_t * buf_end, int *fire_count)
721 {
722 uint32_t cmd;
723 const uint32_t *buf = *buffer;
724 const uint32_t *next_fire;
725 int burst = 0;
726
727 next_fire = dev_priv->fire_offsets[*fire_count];
728 buf++;
729 cmd = (*buf & 0xFFFF0000) >> 16;
730 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
731 switch (cmd) {
732 case HC_ParaType_CmdVdata:
733 while ((buf < buf_end) &&
734 (*fire_count < dev_priv->num_fire_offsets) &&
735 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
736 while (buf <= next_fire) {
737 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
738 (burst & 63), *buf++);
739 burst += 4;
740 }
741 if ((buf < buf_end)
742 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
743 buf++;
744
745 if (++(*fire_count) < dev_priv->num_fire_offsets)
746 next_fire = dev_priv->fire_offsets[*fire_count];
747 }
748 break;
749 default:
750 while (buf < buf_end) {
751
752 if (*buf == HC_HEADER2 ||
753 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
754 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
755 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
756 break;
757
758 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
759 (burst & 63), *buf++);
760 burst += 4;
761 }
762 }
763 *buffer = buf;
764 return state_command;
765 }
766
767 static __inline__ int verify_mmio_address(uint32_t address)
768 {
769 if ((address > 0x3FF) && (address < 0xC00)) {
770 DRM_ERROR("Invalid VIDEO DMA command. "
771 "Attempt to access 3D- or command burst area.\n");
772 return 1;
773 } else if ((address > 0xCFF) && (address < 0x1300)) {
774 DRM_ERROR("Invalid VIDEO DMA command. "
775 "Attempt to access PCI DMA area.\n");
776 return 1;
777 } else if (address > 0x13FF) {
778 DRM_ERROR("Invalid VIDEO DMA command. "
779 "Attempt to access VGA registers.\n");
780 return 1;
781 }
782 return 0;
783 }
784
785 static __inline__ int
786 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
787 uint32_t dwords)
788 {
789 const uint32_t *buf = *buffer;
790
791 if (buf_end - buf < dwords) {
792 DRM_ERROR("Illegal termination of video command.\n");
793 return 1;
794 }
795 while (dwords--) {
796 if (*buf++) {
797 DRM_ERROR("Illegal video command tail.\n");
798 return 1;
799 }
800 }
801 *buffer = buf;
802 return 0;
803 }
804
805 static __inline__ verifier_state_t
806 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
807 {
808 uint32_t cmd;
809 const uint32_t *buf = *buffer;
810 verifier_state_t ret = state_command;
811
812 while (buf < buf_end) {
813 cmd = *buf;
814 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
815 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
816 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
817 break;
818 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
819 "Attempt to access 3D- or command burst area.\n");
820 ret = state_error;
821 break;
822 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
823 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
824 break;
825 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
826 "Attempt to access VGA registers.\n");
827 ret = state_error;
828 break;
829 } else {
830 buf += 2;
831 }
832 }
833 *buffer = buf;
834 return ret;
835 }
836
837 static __inline__ verifier_state_t
838 via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer,
839 const uint32_t * buf_end)
840 {
841 register uint32_t cmd;
842 const uint32_t *buf = *buffer;
843
844 while (buf < buf_end) {
845 cmd = *buf;
846 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
847 break;
848 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
849 buf++;
850 }
851 *buffer = buf;
852 return state_command;
853 }
854
855 static __inline__ verifier_state_t
856 via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end)
857 {
858 uint32_t data;
859 const uint32_t *buf = *buffer;
860
861 if (buf_end - buf < 4) {
862 DRM_ERROR("Illegal termination of video header5 command\n");
863 return state_error;
864 }
865
866 data = *buf++ & ~VIA_VIDEOMASK;
867 if (verify_mmio_address(data))
868 return state_error;
869
870 data = *buf++;
871 if (*buf++ != 0x00F50000) {
872 DRM_ERROR("Illegal header5 header data\n");
873 return state_error;
874 }
875 if (*buf++ != 0x00000000) {
876 DRM_ERROR("Illegal header5 header data\n");
877 return state_error;
878 }
879 if (eat_words(&buf, buf_end, data))
880 return state_error;
881 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
882 return state_error;
883 *buffer = buf;
884 return state_command;
885
886 }
887
888 static __inline__ verifier_state_t
889 via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer,
890 const uint32_t * buf_end)
891 {
892 uint32_t addr, count, i;
893 const uint32_t *buf = *buffer;
894
895 addr = *buf++ & ~VIA_VIDEOMASK;
896 i = count = *buf;
897 buf += 3;
898 while (i--) {
899 VIA_WRITE(addr, *buf++);
900 }
901 if (count & 3)
902 buf += 4 - (count & 3);
903 *buffer = buf;
904 return state_command;
905 }
906
907 static __inline__ verifier_state_t
908 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
909 {
910 uint32_t data;
911 const uint32_t *buf = *buffer;
912 uint32_t i;
913
914 if (buf_end - buf < 4) {
915 DRM_ERROR("Illegal termination of video header6 command\n");
916 return state_error;
917 }
918 buf++;
919 data = *buf++;
920 if (*buf++ != 0x00F60000) {
921 DRM_ERROR("Illegal header6 header data\n");
922 return state_error;
923 }
924 if (*buf++ != 0x00000000) {
925 DRM_ERROR("Illegal header6 header data\n");
926 return state_error;
927 }
928 if ((buf_end - buf) < (data << 1)) {
929 DRM_ERROR("Illegal termination of video header6 command\n");
930 return state_error;
931 }
932 for (i = 0; i < data; ++i) {
933 if (verify_mmio_address(*buf++))
934 return state_error;
935 buf++;
936 }
937 data <<= 1;
938 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
939 return state_error;
940 *buffer = buf;
941 return state_command;
942 }
943
944 static __inline__ verifier_state_t
945 via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer,
946 const uint32_t * buf_end)
947 {
948
949 uint32_t addr, count, i;
950 const uint32_t *buf = *buffer;
951
952 i = count = *++buf;
953 buf += 3;
954 while (i--) {
955 addr = *buf++;
956 VIA_WRITE(addr, *buf++);
957 }
958 count <<= 1;
959 if (count & 3)
960 buf += 4 - (count & 3);
961 *buffer = buf;
962 return state_command;
963 }
964
965 int
966 via_verify_command_stream(const uint32_t * buf, unsigned int size,
967 drm_device_t * dev, int agp)
968 {
969
970 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
971 drm_via_state_t *hc_state = &dev_priv->hc_state;
972 drm_via_state_t saved_state = *hc_state;
973 uint32_t cmd;
974 const uint32_t *buf_end = buf + (size >> 2);
975 verifier_state_t state = state_command;
976 int cme_video;
977 int supported_3d;
978
979 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
980 dev_priv->chipset == VIA_DX9_0);
981
982 supported_3d = dev_priv->chipset != VIA_DX9_0;
983
984 hc_state->dev = dev;
985 hc_state->unfinished = no_sequence;
986 hc_state->map_cache = NULL;
987 hc_state->agp = agp;
988 hc_state->buf_start = buf;
989 dev_priv->num_fire_offsets = 0;
990
991 while (buf < buf_end) {
992
993 switch (state) {
994 case state_header2:
995 state = via_check_header2(&buf, buf_end, hc_state);
996 break;
997 case state_header1:
998 state = via_check_header1(&buf, buf_end);
999 break;
1000 case state_vheader5:
1001 state = via_check_vheader5(&buf, buf_end);
1002 break;
1003 case state_vheader6:
1004 state = via_check_vheader6(&buf, buf_end);
1005 break;
1006 case state_command:
1007 if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1008 supported_3d)
1009 state = state_header2;
1010 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1011 state = state_header1;
1012 else if (cme_video
1013 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1014 state = state_vheader5;
1015 else if (cme_video
1016 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1017 state = state_vheader6;
1018 else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1019 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1020 state = state_error;
1021 } else {
1022 DRM_ERROR
1023 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1024 cmd);
1025 state = state_error;
1026 }
1027 break;
1028 case state_error:
1029 default:
1030 *hc_state = saved_state;
1031 return DRM_ERR(EINVAL);
1032 }
1033 }
1034 if (state == state_error) {
1035 *hc_state = saved_state;
1036 return DRM_ERR(EINVAL);
1037 }
1038 return 0;
1039 }
1040
1041 int
1042 via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
1043 unsigned int size)
1044 {
1045
1046 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1047 uint32_t cmd;
1048 const uint32_t *buf_end = buf + (size >> 2);
1049 verifier_state_t state = state_command;
1050 int fire_count = 0;
1051
1052 while (buf < buf_end) {
1053
1054 switch (state) {
1055 case state_header2:
1056 state =
1057 via_parse_header2(dev_priv, &buf, buf_end,
1058 &fire_count);
1059 break;
1060 case state_header1:
1061 state = via_parse_header1(dev_priv, &buf, buf_end);
1062 break;
1063 case state_vheader5:
1064 state = via_parse_vheader5(dev_priv, &buf, buf_end);
1065 break;
1066 case state_vheader6:
1067 state = via_parse_vheader6(dev_priv, &buf, buf_end);
1068 break;
1069 case state_command:
1070 if (HALCYON_HEADER2 == (cmd = *buf))
1071 state = state_header2;
1072 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1073 state = state_header1;
1074 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1075 state = state_vheader5;
1076 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1077 state = state_vheader6;
1078 else {
1079 DRM_ERROR
1080 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1081 cmd);
1082 state = state_error;
1083 }
1084 break;
1085 case state_error:
1086 default:
1087 return DRM_ERR(EINVAL);
1088 }
1089 }
1090 if (state == state_error) {
1091 return DRM_ERR(EINVAL);
1092 }
1093 return 0;
1094 }
1095
1096 static void
1097 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1098 {
1099 int i;
1100
1101 for (i = 0; i < 256; ++i) {
1102 table[i] = forbidden_command;
1103 }
1104
1105 for (i = 0; i < size; ++i) {
1106 table[init_table[i].code] = init_table[i].hz;
1107 }
1108 }
1109
1110 void via_init_command_verifier(void)
1111 {
1112 setup_hazard_table(init_table1, table1,
1113 sizeof(init_table1) / sizeof(hz_init_t));
1114 setup_hazard_table(init_table2, table2,
1115 sizeof(init_table2) / sizeof(hz_init_t));
1116 setup_hazard_table(init_table3, table3,
1117 sizeof(init_table3) / sizeof(hz_init_t));
1118 }
Verdex Pro support