via_verifier.c revision 1.1.1.1.4.2
1 /* 2 * Copyright 2004 The Unichrome Project. All Rights Reserved. 3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved. 4 * 5 * Permission is hereby granted, free of charge, to any person obtaining a 6 * copy of this software and associated documentation files (the "Software"), 7 * to deal in the Software without restriction, including without limitation 8 * the rights to use, copy, modify, merge, publish, distribute, sub license, 9 * and/or sell copies of the Software, and to permit persons to whom the 10 * Software is furnished to do so, subject to the following conditions: 11 * 12 * The above copyright notice and this permission notice (including the 13 * next paragraph) shall be included in all copies or substantial portions 14 * of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 22 * DEALINGS IN THE SOFTWARE. 23 * 24 * Author: Thomas Hellstrom 2004, 2005. 25 * This code was written using docs obtained under NDA from VIA Inc. 26 * 27 * Don't run this code directly on an AGP buffer. Due to cache problems it will 28 * be very slow. 29 */ 30 31 #include "via_3d_reg.h" 32 #include <drm/drmP.h> 33 #include <drm/via_drm.h> 34 #include "via_verifier.h" 35 #include "via_drv.h" 36 37 typedef enum { 38 state_command, 39 state_header2, 40 state_header1, 41 state_vheader5, 42 state_vheader6, 43 state_error 44 } verifier_state_t; 45 46 typedef enum { 47 no_check = 0, 48 check_for_header2, 49 check_for_header1, 50 check_for_header2_err, 51 check_for_header1_err, 52 check_for_fire, 53 check_z_buffer_addr0, 54 check_z_buffer_addr1, 55 check_z_buffer_addr_mode, 56 check_destination_addr0, 57 check_destination_addr1, 58 check_destination_addr_mode, 59 check_for_dummy, 60 check_for_dd, 61 check_texture_addr0, 62 check_texture_addr1, 63 check_texture_addr2, 64 check_texture_addr3, 65 check_texture_addr4, 66 check_texture_addr5, 67 check_texture_addr6, 68 check_texture_addr7, 69 check_texture_addr8, 70 check_texture_addr_mode, 71 check_for_vertex_count, 72 check_number_texunits, 73 forbidden_command 74 } hazard_t; 75 76 /* 77 * Associates each hazard above with a possible multi-command 78 * sequence. For example an address that is split over multiple 79 * commands and that needs to be checked at the first command 80 * that does not include any part of the address. 81 */ 82 83 static drm_via_sequence_t seqs[] = { 84 no_sequence, 85 no_sequence, 86 no_sequence, 87 no_sequence, 88 no_sequence, 89 no_sequence, 90 z_address, 91 z_address, 92 z_address, 93 dest_address, 94 dest_address, 95 dest_address, 96 no_sequence, 97 no_sequence, 98 tex_address, 99 tex_address, 100 tex_address, 101 tex_address, 102 tex_address, 103 tex_address, 104 tex_address, 105 tex_address, 106 tex_address, 107 tex_address, 108 no_sequence 109 }; 110 111 typedef struct { 112 unsigned int code; 113 hazard_t hz; 114 } hz_init_t; 115 116 static hz_init_t init_table1[] = { 117 {0xf2, check_for_header2_err}, 118 {0xf0, check_for_header1_err}, 119 {0xee, check_for_fire}, 120 {0xcc, check_for_dummy}, 121 {0xdd, check_for_dd}, 122 {0x00, no_check}, 123 {0x10, check_z_buffer_addr0}, 124 {0x11, check_z_buffer_addr1}, 125 {0x12, check_z_buffer_addr_mode}, 126 {0x13, no_check}, 127 {0x14, no_check}, 128 {0x15, no_check}, 129 {0x23, no_check}, 130 {0x24, no_check}, 131 {0x33, no_check}, 132 {0x34, no_check}, 133 {0x35, no_check}, 134 {0x36, no_check}, 135 {0x37, no_check}, 136 {0x38, no_check}, 137 {0x39, no_check}, 138 {0x3A, no_check}, 139 {0x3B, no_check}, 140 {0x3C, no_check}, 141 {0x3D, no_check}, 142 {0x3E, no_check}, 143 {0x40, check_destination_addr0}, 144 {0x41, check_destination_addr1}, 145 {0x42, check_destination_addr_mode}, 146 {0x43, no_check}, 147 {0x44, no_check}, 148 {0x50, no_check}, 149 {0x51, no_check}, 150 {0x52, no_check}, 151 {0x53, no_check}, 152 {0x54, no_check}, 153 {0x55, no_check}, 154 {0x56, no_check}, 155 {0x57, no_check}, 156 {0x58, no_check}, 157 {0x70, no_check}, 158 {0x71, no_check}, 159 {0x78, no_check}, 160 {0x79, no_check}, 161 {0x7A, no_check}, 162 {0x7B, no_check}, 163 {0x7C, no_check}, 164 {0x7D, check_for_vertex_count} 165 }; 166 167 static hz_init_t init_table2[] = { 168 {0xf2, check_for_header2_err}, 169 {0xf0, check_for_header1_err}, 170 {0xee, check_for_fire}, 171 {0xcc, check_for_dummy}, 172 {0x00, check_texture_addr0}, 173 {0x01, check_texture_addr0}, 174 {0x02, check_texture_addr0}, 175 {0x03, check_texture_addr0}, 176 {0x04, check_texture_addr0}, 177 {0x05, check_texture_addr0}, 178 {0x06, check_texture_addr0}, 179 {0x07, check_texture_addr0}, 180 {0x08, check_texture_addr0}, 181 {0x09, check_texture_addr0}, 182 {0x20, check_texture_addr1}, 183 {0x21, check_texture_addr1}, 184 {0x22, check_texture_addr1}, 185 {0x23, check_texture_addr4}, 186 {0x2B, check_texture_addr3}, 187 {0x2C, check_texture_addr3}, 188 {0x2D, check_texture_addr3}, 189 {0x2E, check_texture_addr3}, 190 {0x2F, check_texture_addr3}, 191 {0x30, check_texture_addr3}, 192 {0x31, check_texture_addr3}, 193 {0x32, check_texture_addr3}, 194 {0x33, check_texture_addr3}, 195 {0x34, check_texture_addr3}, 196 {0x4B, check_texture_addr5}, 197 {0x4C, check_texture_addr6}, 198 {0x51, check_texture_addr7}, 199 {0x52, check_texture_addr8}, 200 {0x77, check_texture_addr2}, 201 {0x78, no_check}, 202 {0x79, no_check}, 203 {0x7A, no_check}, 204 {0x7B, check_texture_addr_mode}, 205 {0x7C, no_check}, 206 {0x7D, no_check}, 207 {0x7E, no_check}, 208 {0x7F, no_check}, 209 {0x80, no_check}, 210 {0x81, no_check}, 211 {0x82, no_check}, 212 {0x83, no_check}, 213 {0x85, no_check}, 214 {0x86, no_check}, 215 {0x87, no_check}, 216 {0x88, no_check}, 217 {0x89, no_check}, 218 {0x8A, no_check}, 219 {0x90, no_check}, 220 {0x91, no_check}, 221 {0x92, no_check}, 222 {0x93, no_check} 223 }; 224 225 static hz_init_t init_table3[] = { 226 {0xf2, check_for_header2_err}, 227 {0xf0, check_for_header1_err}, 228 {0xcc, check_for_dummy}, 229 {0x00, check_number_texunits} 230 }; 231 232 static hazard_t table1[256]; 233 static hazard_t table2[256]; 234 static hazard_t table3[256]; 235 236 static __inline__ int 237 eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words) 238 { 239 if ((buf_end - *buf) >= num_words) { 240 *buf += num_words; 241 return 0; 242 } 243 DRM_ERROR("Illegal termination of DMA command buffer\n"); 244 return 1; 245 } 246 247 /* 248 * Partially stolen from drm_memory.h 249 */ 250 251 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq, 252 unsigned long offset, 253 unsigned long size, 254 struct drm_device *dev) 255 { 256 struct drm_map_list *r_list; 257 drm_local_map_t *map = seq->map_cache; 258 259 if (map && map->offset <= offset 260 && (offset + size) <= (map->offset + map->size)) { 261 return map; 262 } 263 264 list_for_each_entry(r_list, &dev->maplist, head) { 265 map = r_list->map; 266 if (!map) 267 continue; 268 if (map->offset <= offset 269 && (offset + size) <= (map->offset + map->size) 270 && !(map->flags & _DRM_RESTRICTED) 271 && (map->type == _DRM_AGP)) { 272 seq->map_cache = map; 273 return map; 274 } 275 } 276 return NULL; 277 } 278 279 /* 280 * Require that all AGP texture levels reside in the same AGP map which should 281 * be mappable by the client. This is not a big restriction. 282 * FIXME: To actually enforce this security policy strictly, drm_rmmap 283 * would have to wait for dma quiescent before removing an AGP map. 284 * The via_drm_lookup_agp_map call in reality seems to take 285 * very little CPU time. 286 */ 287 288 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq) 289 { 290 switch (cur_seq->unfinished) { 291 case z_address: 292 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr); 293 break; 294 case dest_address: 295 DRM_DEBUG("Destination start address is 0x%x\n", 296 cur_seq->d_addr); 297 break; 298 case tex_address: 299 if (cur_seq->agp_texture) { 300 unsigned start = 301 cur_seq->tex_level_lo[cur_seq->texture]; 302 unsigned end = cur_seq->tex_level_hi[cur_seq->texture]; 303 unsigned long lo = ~0, hi = 0, tmp; 304 uint32_t *addr, *pitch, *height, tex; 305 unsigned i; 306 int npot; 307 308 if (end > 9) 309 end = 9; 310 if (start > 9) 311 start = 9; 312 313 addr = 314 &(cur_seq->t_addr[tex = cur_seq->texture][start]); 315 pitch = &(cur_seq->pitch[tex][start]); 316 height = &(cur_seq->height[tex][start]); 317 npot = cur_seq->tex_npot[tex]; 318 for (i = start; i <= end; ++i) { 319 tmp = *addr++; 320 if (tmp < lo) 321 lo = tmp; 322 if (i == 0 && npot) 323 tmp += (*height++ * *pitch++); 324 else 325 tmp += (*height++ << *pitch++); 326 if (tmp > hi) 327 hi = tmp; 328 } 329 330 if (!via_drm_lookup_agp_map 331 (cur_seq, lo, hi - lo, cur_seq->dev)) { 332 DRM_ERROR 333 ("AGP texture is not in allowed map\n"); 334 return 2; 335 } 336 } 337 break; 338 default: 339 break; 340 } 341 cur_seq->unfinished = no_sequence; 342 return 0; 343 } 344 345 static __inline__ int 346 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq) 347 { 348 register uint32_t tmp, *tmp_addr; 349 350 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) { 351 int ret; 352 if ((ret = finish_current_sequence(cur_seq))) 353 return ret; 354 } 355 356 switch (hz) { 357 case check_for_header2: 358 if (cmd == HALCYON_HEADER2) 359 return 1; 360 return 0; 361 case check_for_header1: 362 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 363 return 1; 364 return 0; 365 case check_for_header2_err: 366 if (cmd == HALCYON_HEADER2) 367 return 1; 368 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n"); 369 break; 370 case check_for_header1_err: 371 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 372 return 1; 373 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n"); 374 break; 375 case check_for_fire: 376 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD) 377 return 1; 378 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n"); 379 break; 380 case check_for_dummy: 381 if (HC_DUMMY == cmd) 382 return 0; 383 DRM_ERROR("Illegal DMA HC_DUMMY command\n"); 384 break; 385 case check_for_dd: 386 if (0xdddddddd == cmd) 387 return 0; 388 DRM_ERROR("Illegal DMA 0xdddddddd command\n"); 389 break; 390 case check_z_buffer_addr0: 391 cur_seq->unfinished = z_address; 392 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) | 393 (cmd & 0x00FFFFFF); 394 return 0; 395 case check_z_buffer_addr1: 396 cur_seq->unfinished = z_address; 397 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) | 398 ((cmd & 0xFF) << 24); 399 return 0; 400 case check_z_buffer_addr_mode: 401 cur_seq->unfinished = z_address; 402 if ((cmd & 0x0000C000) == 0) 403 return 0; 404 DRM_ERROR("Attempt to place Z buffer in system memory\n"); 405 return 2; 406 case check_destination_addr0: 407 cur_seq->unfinished = dest_address; 408 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) | 409 (cmd & 0x00FFFFFF); 410 return 0; 411 case check_destination_addr1: 412 cur_seq->unfinished = dest_address; 413 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) | 414 ((cmd & 0xFF) << 24); 415 return 0; 416 case check_destination_addr_mode: 417 cur_seq->unfinished = dest_address; 418 if ((cmd & 0x0000C000) == 0) 419 return 0; 420 DRM_ERROR 421 ("Attempt to place 3D drawing buffer in system memory\n"); 422 return 2; 423 case check_texture_addr0: 424 cur_seq->unfinished = tex_address; 425 tmp = (cmd >> 24); 426 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 427 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF); 428 return 0; 429 case check_texture_addr1: 430 cur_seq->unfinished = tex_address; 431 tmp = ((cmd >> 24) - 0x20); 432 tmp += tmp << 1; 433 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; 434 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 435 tmp_addr++; 436 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16); 437 tmp_addr++; 438 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8); 439 return 0; 440 case check_texture_addr2: 441 cur_seq->unfinished = tex_address; 442 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F; 443 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6; 444 return 0; 445 case check_texture_addr3: 446 cur_seq->unfinished = tex_address; 447 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit); 448 if (tmp == 0 && 449 (cmd & HC_HTXnEnPit_MASK)) { 450 cur_seq->pitch[cur_seq->texture][tmp] = 451 (cmd & HC_HTXnLnPit_MASK); 452 cur_seq->tex_npot[cur_seq->texture] = 1; 453 } else { 454 cur_seq->pitch[cur_seq->texture][tmp] = 455 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT; 456 cur_seq->tex_npot[cur_seq->texture] = 0; 457 if (cmd & 0x000FFFFF) { 458 DRM_ERROR 459 ("Unimplemented texture level 0 pitch mode.\n"); 460 return 2; 461 } 462 } 463 return 0; 464 case check_texture_addr4: 465 cur_seq->unfinished = tex_address; 466 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9]; 467 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); 468 return 0; 469 case check_texture_addr5: 470 case check_texture_addr6: 471 cur_seq->unfinished = tex_address; 472 /* 473 * Texture width. We don't care since we have the pitch. 474 */ 475 return 0; 476 case check_texture_addr7: 477 cur_seq->unfinished = tex_address; 478 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 479 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20); 480 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16); 481 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12); 482 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8); 483 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4); 484 tmp_addr[0] = 1 << (cmd & 0x0000000F); 485 return 0; 486 case check_texture_addr8: 487 cur_seq->unfinished = tex_address; 488 tmp_addr = &(cur_seq->height[cur_seq->texture][0]); 489 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12); 490 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8); 491 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4); 492 tmp_addr[6] = 1 << (cmd & 0x0000000F); 493 return 0; 494 case check_texture_addr_mode: 495 cur_seq->unfinished = tex_address; 496 if (2 == (tmp = cmd & 0x00000003)) { 497 DRM_ERROR 498 ("Attempt to fetch texture from system memory.\n"); 499 return 2; 500 } 501 cur_seq->agp_texture = (tmp == 3); 502 cur_seq->tex_palette_size[cur_seq->texture] = 503 (cmd >> 16) & 0x000000007; 504 return 0; 505 case check_for_vertex_count: 506 cur_seq->vertex_count = cmd & 0x0000FFFF; 507 return 0; 508 case check_number_texunits: 509 cur_seq->multitex = (cmd >> 3) & 1; 510 return 0; 511 default: 512 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd); 513 return 2; 514 } 515 return 2; 516 } 517 518 static __inline__ int 519 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end, 520 drm_via_state_t *cur_seq) 521 { 522 drm_via_private_t *dev_priv = 523 (drm_via_private_t *) cur_seq->dev->dev_private; 524 uint32_t a_fire, bcmd, dw_count; 525 int ret = 0; 526 int have_fire; 527 const uint32_t *buf = *buffer; 528 529 while (buf < buf_end) { 530 have_fire = 0; 531 if ((buf_end - buf) < 2) { 532 DRM_ERROR 533 ("Unexpected termination of primitive list.\n"); 534 ret = 1; 535 break; 536 } 537 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB) 538 break; 539 bcmd = *buf++; 540 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) { 541 DRM_ERROR("Expected Vertex List A command, got 0x%x\n", 542 *buf); 543 ret = 1; 544 break; 545 } 546 a_fire = 547 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK | 548 HC_HE3Fire_MASK; 549 550 /* 551 * How many dwords per vertex ? 552 */ 553 554 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) { 555 DRM_ERROR("Illegal B command vertex data for AGP.\n"); 556 ret = 1; 557 break; 558 } 559 560 dw_count = 0; 561 if (bcmd & (1 << 7)) 562 dw_count += (cur_seq->multitex) ? 2 : 1; 563 if (bcmd & (1 << 8)) 564 dw_count += (cur_seq->multitex) ? 2 : 1; 565 if (bcmd & (1 << 9)) 566 dw_count++; 567 if (bcmd & (1 << 10)) 568 dw_count++; 569 if (bcmd & (1 << 11)) 570 dw_count++; 571 if (bcmd & (1 << 12)) 572 dw_count++; 573 if (bcmd & (1 << 13)) 574 dw_count++; 575 if (bcmd & (1 << 14)) 576 dw_count++; 577 578 while (buf < buf_end) { 579 if (*buf == a_fire) { 580 if (dev_priv->num_fire_offsets >= 581 VIA_FIRE_BUF_SIZE) { 582 DRM_ERROR("Fire offset buffer full.\n"); 583 ret = 1; 584 break; 585 } 586 dev_priv->fire_offsets[dev_priv-> 587 num_fire_offsets++] = 588 buf; 589 have_fire = 1; 590 buf++; 591 if (buf < buf_end && *buf == a_fire) 592 buf++; 593 break; 594 } 595 if ((*buf == HALCYON_HEADER2) || 596 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) { 597 DRM_ERROR("Missing Vertex Fire command, " 598 "Stray Vertex Fire command or verifier " 599 "lost sync.\n"); 600 ret = 1; 601 break; 602 } 603 if ((ret = eat_words(&buf, buf_end, dw_count))) 604 break; 605 } 606 if (buf >= buf_end && !have_fire) { 607 DRM_ERROR("Missing Vertex Fire command or verifier " 608 "lost sync.\n"); 609 ret = 1; 610 break; 611 } 612 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) { 613 DRM_ERROR("AGP Primitive list end misaligned.\n"); 614 ret = 1; 615 break; 616 } 617 } 618 *buffer = buf; 619 return ret; 620 } 621 622 static __inline__ verifier_state_t 623 via_check_header2(uint32_t const **buffer, const uint32_t *buf_end, 624 drm_via_state_t *hc_state) 625 { 626 uint32_t cmd; 627 int hz_mode; 628 hazard_t hz; 629 const uint32_t *buf = *buffer; 630 const hazard_t *hz_table; 631 632 if ((buf_end - buf) < 2) { 633 DRM_ERROR 634 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n"); 635 return state_error; 636 } 637 buf++; 638 cmd = (*buf++ & 0xFFFF0000) >> 16; 639 640 switch (cmd) { 641 case HC_ParaType_CmdVdata: 642 if (via_check_prim_list(&buf, buf_end, hc_state)) 643 return state_error; 644 *buffer = buf; 645 return state_command; 646 case HC_ParaType_NotTex: 647 hz_table = table1; 648 break; 649 case HC_ParaType_Tex: 650 hc_state->texture = 0; 651 hz_table = table2; 652 break; 653 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)): 654 hc_state->texture = 1; 655 hz_table = table2; 656 break; 657 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)): 658 hz_table = table3; 659 break; 660 case HC_ParaType_Auto: 661 if (eat_words(&buf, buf_end, 2)) 662 return state_error; 663 *buffer = buf; 664 return state_command; 665 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)): 666 if (eat_words(&buf, buf_end, 32)) 667 return state_error; 668 *buffer = buf; 669 return state_command; 670 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)): 671 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)): 672 DRM_ERROR("Texture palettes are rejected because of " 673 "lack of info how to determine their size.\n"); 674 return state_error; 675 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)): 676 DRM_ERROR("Fog factor palettes are rejected because of " 677 "lack of info how to determine their size.\n"); 678 return state_error; 679 default: 680 681 /* 682 * There are some unimplemented HC_ParaTypes here, that 683 * need to be implemented if the Mesa driver is extended. 684 */ 685 686 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 " 687 "DMA subcommand: 0x%x. Previous dword: 0x%x\n", 688 cmd, *(buf - 2)); 689 *buffer = buf; 690 return state_error; 691 } 692 693 while (buf < buf_end) { 694 cmd = *buf++; 695 if ((hz = hz_table[cmd >> 24])) { 696 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) { 697 if (hz_mode == 1) { 698 buf--; 699 break; 700 } 701 return state_error; 702 } 703 } else if (hc_state->unfinished && 704 finish_current_sequence(hc_state)) { 705 return state_error; 706 } 707 } 708 if (hc_state->unfinished && finish_current_sequence(hc_state)) 709 return state_error; 710 *buffer = buf; 711 return state_command; 712 } 713 714 static __inline__ verifier_state_t 715 via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer, 716 const uint32_t *buf_end, int *fire_count) 717 { 718 uint32_t cmd; 719 const uint32_t *buf = *buffer; 720 const uint32_t *next_fire; 721 int burst = 0; 722 723 next_fire = dev_priv->fire_offsets[*fire_count]; 724 buf++; 725 cmd = (*buf & 0xFFFF0000) >> 16; 726 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++); 727 switch (cmd) { 728 case HC_ParaType_CmdVdata: 729 while ((buf < buf_end) && 730 (*fire_count < dev_priv->num_fire_offsets) && 731 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) { 732 while (buf <= next_fire) { 733 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 734 (burst & 63), *buf++); 735 burst += 4; 736 } 737 if ((buf < buf_end) 738 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) 739 buf++; 740 741 if (++(*fire_count) < dev_priv->num_fire_offsets) 742 next_fire = dev_priv->fire_offsets[*fire_count]; 743 } 744 break; 745 default: 746 while (buf < buf_end) { 747 748 if (*buf == HC_HEADER2 || 749 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 || 750 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 || 751 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 752 break; 753 754 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + 755 (burst & 63), *buf++); 756 burst += 4; 757 } 758 } 759 *buffer = buf; 760 return state_command; 761 } 762 763 static __inline__ int verify_mmio_address(uint32_t address) 764 { 765 if ((address > 0x3FF) && (address < 0xC00)) { 766 DRM_ERROR("Invalid VIDEO DMA command. " 767 "Attempt to access 3D- or command burst area.\n"); 768 return 1; 769 } else if ((address > 0xCFF) && (address < 0x1300)) { 770 DRM_ERROR("Invalid VIDEO DMA command. " 771 "Attempt to access PCI DMA area.\n"); 772 return 1; 773 } else if (address > 0x13FF) { 774 DRM_ERROR("Invalid VIDEO DMA command. " 775 "Attempt to access VGA registers.\n"); 776 return 1; 777 } 778 return 0; 779 } 780 781 static __inline__ int 782 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end, 783 uint32_t dwords) 784 { 785 const uint32_t *buf = *buffer; 786 787 if (buf_end - buf < dwords) { 788 DRM_ERROR("Illegal termination of video command.\n"); 789 return 1; 790 } 791 while (dwords--) { 792 if (*buf++) { 793 DRM_ERROR("Illegal video command tail.\n"); 794 return 1; 795 } 796 } 797 *buffer = buf; 798 return 0; 799 } 800 801 static __inline__ verifier_state_t 802 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end) 803 { 804 uint32_t cmd; 805 const uint32_t *buf = *buffer; 806 verifier_state_t ret = state_command; 807 808 while (buf < buf_end) { 809 cmd = *buf; 810 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) && 811 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) { 812 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 813 break; 814 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 815 "Attempt to access 3D- or command burst area.\n"); 816 ret = state_error; 817 break; 818 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) { 819 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 820 break; 821 DRM_ERROR("Invalid HALCYON_HEADER1 command. " 822 "Attempt to access VGA registers.\n"); 823 ret = state_error; 824 break; 825 } else { 826 buf += 2; 827 } 828 } 829 *buffer = buf; 830 return ret; 831 } 832 833 static __inline__ verifier_state_t 834 via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer, 835 const uint32_t *buf_end) 836 { 837 register uint32_t cmd; 838 const uint32_t *buf = *buffer; 839 840 while (buf < buf_end) { 841 cmd = *buf; 842 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) 843 break; 844 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf); 845 buf++; 846 } 847 *buffer = buf; 848 return state_command; 849 } 850 851 static __inline__ verifier_state_t 852 via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end) 853 { 854 uint32_t data; 855 const uint32_t *buf = *buffer; 856 857 if (buf_end - buf < 4) { 858 DRM_ERROR("Illegal termination of video header5 command\n"); 859 return state_error; 860 } 861 862 data = *buf++ & ~VIA_VIDEOMASK; 863 if (verify_mmio_address(data)) 864 return state_error; 865 866 data = *buf++; 867 if (*buf++ != 0x00F50000) { 868 DRM_ERROR("Illegal header5 header data\n"); 869 return state_error; 870 } 871 if (*buf++ != 0x00000000) { 872 DRM_ERROR("Illegal header5 header data\n"); 873 return state_error; 874 } 875 if (eat_words(&buf, buf_end, data)) 876 return state_error; 877 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 878 return state_error; 879 *buffer = buf; 880 return state_command; 881 882 } 883 884 static __inline__ verifier_state_t 885 via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer, 886 const uint32_t *buf_end) 887 { 888 uint32_t addr, count, i; 889 const uint32_t *buf = *buffer; 890 891 addr = *buf++ & ~VIA_VIDEOMASK; 892 i = count = *buf; 893 buf += 3; 894 while (i--) 895 VIA_WRITE(addr, *buf++); 896 if (count & 3) 897 buf += 4 - (count & 3); 898 *buffer = buf; 899 return state_command; 900 } 901 902 static __inline__ verifier_state_t 903 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end) 904 { 905 uint32_t data; 906 const uint32_t *buf = *buffer; 907 uint32_t i; 908 909 if (buf_end - buf < 4) { 910 DRM_ERROR("Illegal termination of video header6 command\n"); 911 return state_error; 912 } 913 buf++; 914 data = *buf++; 915 if (*buf++ != 0x00F60000) { 916 DRM_ERROR("Illegal header6 header data\n"); 917 return state_error; 918 } 919 if (*buf++ != 0x00000000) { 920 DRM_ERROR("Illegal header6 header data\n"); 921 return state_error; 922 } 923 if ((buf_end - buf) < (data << 1)) { 924 DRM_ERROR("Illegal termination of video header6 command\n"); 925 return state_error; 926 } 927 for (i = 0; i < data; ++i) { 928 if (verify_mmio_address(*buf++)) 929 return state_error; 930 buf++; 931 } 932 data <<= 1; 933 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3))) 934 return state_error; 935 *buffer = buf; 936 return state_command; 937 } 938 939 static __inline__ verifier_state_t 940 via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer, 941 const uint32_t *buf_end) 942 { 943 944 uint32_t addr, count, i; 945 const uint32_t *buf = *buffer; 946 947 i = count = *++buf; 948 buf += 3; 949 while (i--) { 950 addr = *buf++; 951 VIA_WRITE(addr, *buf++); 952 } 953 count <<= 1; 954 if (count & 3) 955 buf += 4 - (count & 3); 956 *buffer = buf; 957 return state_command; 958 } 959 960 int 961 via_verify_command_stream(const uint32_t * buf, unsigned int size, 962 struct drm_device * dev, int agp) 963 { 964 965 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 966 drm_via_state_t *hc_state = &dev_priv->hc_state; 967 drm_via_state_t saved_state = *hc_state; 968 uint32_t cmd; 969 const uint32_t *buf_end = buf + (size >> 2); 970 verifier_state_t state = state_command; 971 int cme_video; 972 int supported_3d; 973 974 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A || 975 dev_priv->chipset == VIA_DX9_0); 976 977 supported_3d = dev_priv->chipset != VIA_DX9_0; 978 979 hc_state->dev = dev; 980 hc_state->unfinished = no_sequence; 981 hc_state->map_cache = NULL; 982 hc_state->agp = agp; 983 hc_state->buf_start = buf; 984 dev_priv->num_fire_offsets = 0; 985 986 while (buf < buf_end) { 987 988 switch (state) { 989 case state_header2: 990 state = via_check_header2(&buf, buf_end, hc_state); 991 break; 992 case state_header1: 993 state = via_check_header1(&buf, buf_end); 994 break; 995 case state_vheader5: 996 state = via_check_vheader5(&buf, buf_end); 997 break; 998 case state_vheader6: 999 state = via_check_vheader6(&buf, buf_end); 1000 break; 1001 case state_command: 1002 if ((HALCYON_HEADER2 == (cmd = *buf)) && 1003 supported_3d) 1004 state = state_header2; 1005 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 1006 state = state_header1; 1007 else if (cme_video 1008 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1009 state = state_vheader5; 1010 else if (cme_video 1011 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1012 state = state_vheader6; 1013 else if ((cmd == HALCYON_HEADER2) && !supported_3d) { 1014 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n"); 1015 state = state_error; 1016 } else { 1017 DRM_ERROR 1018 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1019 cmd); 1020 state = state_error; 1021 } 1022 break; 1023 case state_error: 1024 default: 1025 *hc_state = saved_state; 1026 return -EINVAL; 1027 } 1028 } 1029 if (state == state_error) { 1030 *hc_state = saved_state; 1031 return -EINVAL; 1032 } 1033 return 0; 1034 } 1035 1036 int 1037 via_parse_command_stream(struct drm_device *dev, const uint32_t *buf, 1038 unsigned int size) 1039 { 1040 1041 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; 1042 uint32_t cmd; 1043 const uint32_t *buf_end = buf + (size >> 2); 1044 verifier_state_t state = state_command; 1045 int fire_count = 0; 1046 1047 while (buf < buf_end) { 1048 1049 switch (state) { 1050 case state_header2: 1051 state = 1052 via_parse_header2(dev_priv, &buf, buf_end, 1053 &fire_count); 1054 break; 1055 case state_header1: 1056 state = via_parse_header1(dev_priv, &buf, buf_end); 1057 break; 1058 case state_vheader5: 1059 state = via_parse_vheader5(dev_priv, &buf, buf_end); 1060 break; 1061 case state_vheader6: 1062 state = via_parse_vheader6(dev_priv, &buf, buf_end); 1063 break; 1064 case state_command: 1065 if (HALCYON_HEADER2 == (cmd = *buf)) 1066 state = state_header2; 1067 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) 1068 state = state_header1; 1069 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) 1070 state = state_vheader5; 1071 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) 1072 state = state_vheader6; 1073 else { 1074 DRM_ERROR 1075 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n", 1076 cmd); 1077 state = state_error; 1078 } 1079 break; 1080 case state_error: 1081 default: 1082 return -EINVAL; 1083 } 1084 } 1085 if (state == state_error) 1086 return -EINVAL; 1087 return 0; 1088 } 1089 1090 static void 1091 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size) 1092 { 1093 int i; 1094 1095 for (i = 0; i < 256; ++i) 1096 table[i] = forbidden_command; 1097 1098 for (i = 0; i < size; ++i) 1099 table[init_table[i].code] = init_table[i].hz; 1100 } 1101 1102 void via_init_command_verifier(void) 1103 { 1104 setup_hazard_table(init_table1, table1, 1105 sizeof(init_table1) / sizeof(hz_init_t)); 1106 setup_hazard_table(init_table2, table2, 1107 sizeof(init_table2) / sizeof(hz_init_t)); 1108 setup_hazard_table(init_table3, table3, 1109 sizeof(init_table3) / sizeof(hz_init_t)); 1110 } 1111
Indexes created Thu Oct 30 16:09:53 GMT 2025