projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
drm/msm: Remove CRTC .mode_set and .mode_set_base helpers
[linux-2.6-block.git] / drivers / gpu / drm / via / via_verifier.c
CommitLineData
22f579c6
DA		 1/*
2 * Copyright 2004 The Unichrome Project. All Rights Reserved.
3 * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sub license,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial portions
14 * of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22 * DEALINGS IN THE SOFTWARE.
23 *
24 * Author: Thomas Hellstrom 2004, 2005.
25 * This code was written using docs obtained under NDA from VIA Inc.
26 *
27 * Don't run this code directly on an AGP buffer. Due to cache problems it will
28 * be very slow.
29 */
30
22f579c6 31#include "via_3d_reg.h"
760285e7
DH		 32#include <drm/drmP.h>
33#include <drm/via_drm.h>
ba8286fa 34#include <drm/drm_legacy.h>
22f579c6
DA		 35#include "via_verifier.h"
36#include "via_drv.h"
37
b5e89ed5 38typedef enum {
22f579c6
DA		 39 state_command,
40 state_header2,
41 state_header1,
42 state_vheader5,
43 state_vheader6,
44 state_error
45} verifier_state_t;
46
b5e89ed5 47typedef enum {
22f579c6
DA		 48 no_check = 0,
49 check_for_header2,
50 check_for_header1,
51 check_for_header2_err,
52 check_for_header1_err,
53 check_for_fire,
54 check_z_buffer_addr0,
55 check_z_buffer_addr1,
56 check_z_buffer_addr_mode,
57 check_destination_addr0,
58 check_destination_addr1,
59 check_destination_addr_mode,
60 check_for_dummy,
61 check_for_dd,
62 check_texture_addr0,
63 check_texture_addr1,
64 check_texture_addr2,
65 check_texture_addr3,
66 check_texture_addr4,
67 check_texture_addr5,
68 check_texture_addr6,
69 check_texture_addr7,
70 check_texture_addr8,
71 check_texture_addr_mode,
72 check_for_vertex_count,
73 check_number_texunits,
74 forbidden_command
b5e89ed5 75} hazard_t;
22f579c6
DA		 76
77/*
78 * Associates each hazard above with a possible multi-command
79 * sequence. For example an address that is split over multiple
b5e89ed5 80 * commands and that needs to be checked at the first command
22f579c6
DA		 81 * that does not include any part of the address.
82 */
83
b5e89ed5 84static drm_via_sequence_t seqs[] = {
22f579c6
DA		 85 no_sequence,
86 no_sequence,
87 no_sequence,
88 no_sequence,
89 no_sequence,
90 no_sequence,
91 z_address,
92 z_address,
93 z_address,
94 dest_address,
95 dest_address,
96 dest_address,
97 no_sequence,
98 no_sequence,
99 tex_address,
100 tex_address,
101 tex_address,
102 tex_address,
103 tex_address,
104 tex_address,
105 tex_address,
106 tex_address,
107 tex_address,
108 tex_address,
109 no_sequence
110};
b5e89ed5
DA		 111
112typedef struct {
22f579c6
DA		 113 unsigned int code;
114 hazard_t hz;
115} hz_init_t;
116
22f579c6
DA		 117static hz_init_t init_table1[] = {
118 {0xf2, check_for_header2_err},
119 {0xf0, check_for_header1_err},
120 {0xee, check_for_fire},
121 {0xcc, check_for_dummy},
122 {0xdd, check_for_dd},
123 {0x00, no_check},
124 {0x10, check_z_buffer_addr0},
125 {0x11, check_z_buffer_addr1},
126 {0x12, check_z_buffer_addr_mode},
127 {0x13, no_check},
128 {0x14, no_check},
129 {0x15, no_check},
130 {0x23, no_check},
131 {0x24, no_check},
132 {0x33, no_check},
133 {0x34, no_check},
134 {0x35, no_check},
135 {0x36, no_check},
136 {0x37, no_check},
137 {0x38, no_check},
138 {0x39, no_check},
139 {0x3A, no_check},
140 {0x3B, no_check},
141 {0x3C, no_check},
142 {0x3D, no_check},
143 {0x3E, no_check},
144 {0x40, check_destination_addr0},
145 {0x41, check_destination_addr1},
146 {0x42, check_destination_addr_mode},
147 {0x43, no_check},
148 {0x44, no_check},
149 {0x50, no_check},
150 {0x51, no_check},
151 {0x52, no_check},
152 {0x53, no_check},
153 {0x54, no_check},
154 {0x55, no_check},
155 {0x56, no_check},
156 {0x57, no_check},
157 {0x58, no_check},
158 {0x70, no_check},
159 {0x71, no_check},
160 {0x78, no_check},
161 {0x79, no_check},
162 {0x7A, no_check},
163 {0x7B, no_check},
164 {0x7C, no_check},
165 {0x7D, check_for_vertex_count}
166};
167
22f579c6
DA		 168static hz_init_t init_table2[] = {
169 {0xf2, check_for_header2_err},
170 {0xf0, check_for_header1_err},
171 {0xee, check_for_fire},
172 {0xcc, check_for_dummy},
173 {0x00, check_texture_addr0},
174 {0x01, check_texture_addr0},
175 {0x02, check_texture_addr0},
176 {0x03, check_texture_addr0},
177 {0x04, check_texture_addr0},
178 {0x05, check_texture_addr0},
179 {0x06, check_texture_addr0},
180 {0x07, check_texture_addr0},
181 {0x08, check_texture_addr0},
182 {0x09, check_texture_addr0},
183 {0x20, check_texture_addr1},
184 {0x21, check_texture_addr1},
185 {0x22, check_texture_addr1},
186 {0x23, check_texture_addr4},
187 {0x2B, check_texture_addr3},
188 {0x2C, check_texture_addr3},
189 {0x2D, check_texture_addr3},
190 {0x2E, check_texture_addr3},
191 {0x2F, check_texture_addr3},
192 {0x30, check_texture_addr3},
193 {0x31, check_texture_addr3},
194 {0x32, check_texture_addr3},
195 {0x33, check_texture_addr3},
196 {0x34, check_texture_addr3},
197 {0x4B, check_texture_addr5},
198 {0x4C, check_texture_addr6},
199 {0x51, check_texture_addr7},
200 {0x52, check_texture_addr8},
201 {0x77, check_texture_addr2},
202 {0x78, no_check},
203 {0x79, no_check},
204 {0x7A, no_check},
205 {0x7B, check_texture_addr_mode},
206 {0x7C, no_check},
207 {0x7D, no_check},
208 {0x7E, no_check},
209 {0x7F, no_check},
210 {0x80, no_check},
211 {0x81, no_check},
212 {0x82, no_check},
213 {0x83, no_check},
214 {0x85, no_check},
215 {0x86, no_check},
216 {0x87, no_check},
217 {0x88, no_check},
218 {0x89, no_check},
219 {0x8A, no_check},
220 {0x90, no_check},
221 {0x91, no_check},
222 {0x92, no_check},
223 {0x93, no_check}
224};
225
226static hz_init_t init_table3[] = {
227 {0xf2, check_for_header2_err},
228 {0xf0, check_for_header1_err},
229 {0xcc, check_for_dummy},
230 {0x00, check_number_texunits}
231};
22f579c6 232
b5e89ed5
DA		 233static hazard_t table1[256];
234static hazard_t table2[256];
235static hazard_t table3[256];
22f579c6
DA		 236
237static __inline__ int
58c1e85a 238eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
22f579c6 239{
92514243 240 if ((buf_end - *buf) >= num_words) {
22f579c6
DA		 241 *buf += num_words;
242 return 0;
b5e89ed5 243 }
22f579c6
DA		 244 DRM_ERROR("Illegal termination of DMA command buffer\n");
245 return 1;
246}
247
22f579c6
DA		 248/*
249 * Partially stolen from drm_memory.h
250 */
251
92514243 252static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
b5e89ed5
DA		 253 unsigned long offset,
254 unsigned long size,
58c1e85a 255 struct drm_device *dev)
22f579c6 256{
55910517 257 struct drm_map_list *r_list;
92514243 258 drm_local_map_t *map = seq->map_cache;
22f579c6 259
b5e89ed5
DA		 260 if (map && map->offset <= offset
261 && (offset + size) <= (map->offset + map->size)) {
22f579c6
DA		 262 return map;
263 }
b5e89ed5 264
bd1b331f 265 list_for_each_entry(r_list, &dev->maplist, head) {
22f579c6
DA		 266 map = r_list->map;
267 if (!map)
268 continue;
b5e89ed5
DA		 269 if (map->offset <= offset
270 && (offset + size) <= (map->offset + map->size)
271 && !(map->flags & _DRM_RESTRICTED)
272 && (map->type == _DRM_AGP)) {
22f579c6
DA		 273 seq->map_cache = map;
274 return map;
275 }
276 }
277 return NULL;
278}
279
22f579c6 280/*
b5e89ed5 281 * Require that all AGP texture levels reside in the same AGP map which should
22f579c6 282 * be mappable by the client. This is not a big restriction.
b5e89ed5
DA		 283 * FIXME: To actually enforce this security policy strictly, drm_rmmap
284 * would have to wait for dma quiescent before removing an AGP map.
22f579c6
DA		 285 * The via_drm_lookup_agp_map call in reality seems to take
286 * very little CPU time.
287 */
288
b5e89ed5 289static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
22f579c6 290{
b5e89ed5 291 switch (cur_seq->unfinished) {
22f579c6
DA		 292 case z_address:
293 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
294 break;
295 case dest_address:
b5e89ed5
DA		 296 DRM_DEBUG("Destination start address is 0x%x\n",
297 cur_seq->d_addr);
22f579c6
DA		 298 break;
299 case tex_address:
b5e89ed5
DA		 300 if (cur_seq->agp_texture) {
301 unsigned start =
302 cur_seq->tex_level_lo[cur_seq->texture];
22f579c6 303 unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
b5e89ed5 304 unsigned long lo = ~0, hi = 0, tmp;
22f579c6
DA		 305 uint32_t *addr, *pitch, *height, tex;
306 unsigned i;
9b8d9d0e 307 int npot;
22f579c6 308
b5e89ed5
DA		 309 if (end > 9)
310 end = 9;
311 if (start > 9)
312 start = 9;
22f579c6 313
b5e89ed5
DA		 314 addr =
315 &(cur_seq->t_addr[tex = cur_seq->texture][start]);
22f579c6
DA		 316 pitch = &(cur_seq->pitch[tex][start]);
317 height = &(cur_seq->height[tex][start]);
9b8d9d0e 318 npot = cur_seq->tex_npot[tex];
b5e89ed5 319 for (i = start; i <= end; ++i) {
22f579c6 320 tmp = *addr++;
b5e89ed5
DA		 321 if (tmp < lo)
322 lo = tmp;
9b8d9d0e
TH		 323 if (i == 0 && npot)
324 tmp += (*height++ * *pitch++);
325 else
326 tmp += (*height++ << *pitch++);
b5e89ed5
DA		 327 if (tmp > hi)
328 hi = tmp;
22f579c6
DA		 329 }
330
b5e89ed5
DA		 331 if (!via_drm_lookup_agp_map
332 (cur_seq, lo, hi - lo, cur_seq->dev)) {
333 DRM_ERROR
334 ("AGP texture is not in allowed map\n");
22f579c6
DA		 335 return 2;
336 }
b5e89ed5 337 }
22f579c6
DA		 338 break;
339 default:
340 break;
341 }
342 cur_seq->unfinished = no_sequence;
343 return 0;
344}
345
b5e89ed5 346static __inline__ int
58c1e85a 347investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
22f579c6
DA		 348{
349 register uint32_t tmp, *tmp_addr;
350
351 if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
352 int ret;
b5e89ed5
DA		 353 if ((ret = finish_current_sequence(cur_seq)))
354 return ret;
22f579c6
DA		 355 }
356
b5e89ed5 357 switch (hz) {
22f579c6 358 case check_for_header2:
b5e89ed5
DA		 359 if (cmd == HALCYON_HEADER2)
360 return 1;
22f579c6
DA		 361 return 0;
362 case check_for_header1:
b5e89ed5
DA		 363 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
364 return 1;
22f579c6
DA		 365 return 0;
366 case check_for_header2_err:
b5e89ed5
DA		 367 if (cmd == HALCYON_HEADER2)
368 return 1;
22f579c6
DA		 369 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
370 break;
371 case check_for_header1_err:
b5e89ed5
DA		 372 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
373 return 1;
22f579c6
DA		 374 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
375 break;
376 case check_for_fire:
b5e89ed5
DA		 377 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
378 return 1;
22f579c6
DA		 379 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
380 break;
381 case check_for_dummy:
b5e89ed5
DA		 382 if (HC_DUMMY == cmd)
383 return 0;
22f579c6
DA		 384 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
385 break;
386 case check_for_dd:
b5e89ed5
DA		 387 if (0xdddddddd == cmd)
388 return 0;
22f579c6
DA		 389 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
390 break;
391 case check_z_buffer_addr0:
392 cur_seq->unfinished = z_address;
393 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
b5e89ed5 394 (cmd & 0x00FFFFFF);
22f579c6
DA		 395 return 0;
396 case check_z_buffer_addr1:
397 cur_seq->unfinished = z_address;
398 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
b5e89ed5 399 ((cmd & 0xFF) << 24);
22f579c6
DA		 400 return 0;
401 case check_z_buffer_addr_mode:
402 cur_seq->unfinished = z_address;
b5e89ed5
DA		 403 if ((cmd & 0x0000C000) == 0)
404 return 0;
22f579c6
DA		 405 DRM_ERROR("Attempt to place Z buffer in system memory\n");
406 return 2;
407 case check_destination_addr0:
408 cur_seq->unfinished = dest_address;
409 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
b5e89ed5 410 (cmd & 0x00FFFFFF);
22f579c6
DA		 411 return 0;
412 case check_destination_addr1:
413 cur_seq->unfinished = dest_address;
414 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
b5e89ed5 415 ((cmd & 0xFF) << 24);
22f579c6
DA		 416 return 0;
417 case check_destination_addr_mode:
418 cur_seq->unfinished = dest_address;
b5e89ed5
DA		 419 if ((cmd & 0x0000C000) == 0)
420 return 0;
421 DRM_ERROR
422 ("Attempt to place 3D drawing buffer in system memory\n");
423 return 2;
22f579c6
DA		 424 case check_texture_addr0:
425 cur_seq->unfinished = tex_address;
426 tmp = (cmd >> 24);
427 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
428 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
429 return 0;
430 case check_texture_addr1:
431 cur_seq->unfinished = tex_address;
432 tmp = ((cmd >> 24) - 0x20);
433 tmp += tmp << 1;
434 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
435 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
436 tmp_addr++;
437 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
438 tmp_addr++;
439 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
440 return 0;
441 case check_texture_addr2:
442 cur_seq->unfinished = tex_address;
443 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
444 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
445 return 0;
446 case check_texture_addr3:
447 cur_seq->unfinished = tex_address;
9b8d9d0e
TH		 448 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
449 if (tmp == 0 &&
450 (cmd & HC_HTXnEnPit_MASK)) {
451 cur_seq->pitch[cur_seq->texture][tmp] =
452 (cmd & HC_HTXnLnPit_MASK);
453 cur_seq->tex_npot[cur_seq->texture] = 1;
454 } else {
455 cur_seq->pitch[cur_seq->texture][tmp] =
456 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
457 cur_seq->tex_npot[cur_seq->texture] = 0;
458 if (cmd & 0x000FFFFF) {
459 DRM_ERROR
460 ("Unimplemented texture level 0 pitch mode.\n");
461 return 2;
462 }
22f579c6
DA		 463 }
464 return 0;
465 case check_texture_addr4:
466 cur_seq->unfinished = tex_address;
467 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
468 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
469 return 0;
470 case check_texture_addr5:
471 case check_texture_addr6:
472 cur_seq->unfinished = tex_address;
473 /*
474 * Texture width. We don't care since we have the pitch.
b5e89ed5 475 */
22f579c6
DA		 476 return 0;
477 case check_texture_addr7:
478 cur_seq->unfinished = tex_address;
479 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
480 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
481 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
482 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
483 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
484 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
485 tmp_addr[0] = 1 << (cmd & 0x0000000F);
486 return 0;
487 case check_texture_addr8:
488 cur_seq->unfinished = tex_address;
489 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
490 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
b5e89ed5 491 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
22f579c6
DA		 492 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
493 tmp_addr[6] = 1 << (cmd & 0x0000000F);
494 return 0;
495 case check_texture_addr_mode:
496 cur_seq->unfinished = tex_address;
b5e89ed5
DA		 497 if (2 == (tmp = cmd & 0x00000003)) {
498 DRM_ERROR
499 ("Attempt to fetch texture from system memory.\n");
22f579c6
DA		 500 return 2;
501 }
502 cur_seq->agp_texture = (tmp == 3);
b5e89ed5
DA		 503 cur_seq->tex_palette_size[cur_seq->texture] =
504 (cmd >> 16) & 0x000000007;
22f579c6
DA		 505 return 0;
506 case check_for_vertex_count:
507 cur_seq->vertex_count = cmd & 0x0000FFFF;
508 return 0;
509 case check_number_texunits:
b5e89ed5 510 cur_seq->multitex = (cmd >> 3) & 1;
22f579c6
DA		 511 return 0;
512 default:
513 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
514 return 2;
515 }
516 return 2;
517}
518
22f579c6 519static __inline__ int
b5e89ed5 520via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
58c1e85a 521 drm_via_state_t *cur_seq)
22f579c6 522{
b5e89ed5
DA		 523 drm_via_private_t *dev_priv =
524 (drm_via_private_t *) cur_seq->dev->dev_private;
525 uint32_t a_fire, bcmd, dw_count;
22f579c6
DA		 526 int ret = 0;
527 int have_fire;
528 const uint32_t *buf = *buffer;
529
b5e89ed5
DA		 530 while (buf < buf_end) {
531 have_fire = 0;
22f579c6 532 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 533 DRM_ERROR
534 ("Unexpected termination of primitive list.\n");
22f579c6
DA		 535 ret = 1;
536 break;
537 }
b5e89ed5
DA		 538 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
539 break;
22f579c6
DA		 540 bcmd = *buf++;
541 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
542 DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
543 *buf);
544 ret = 1;
545 break;
546 }
b5e89ed5
DA		 547 a_fire =
548 *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
549 HC_HE3Fire_MASK;
550
22f579c6
DA		 551 /*
552 * How many dwords per vertex ?
b5e89ed5
DA		 553 */
554
22f579c6
DA		 555 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
556 DRM_ERROR("Illegal B command vertex data for AGP.\n");
557 ret = 1;
558 break;
b5e89ed5 559 }
22f579c6
DA		 560
561 dw_count = 0;
b5e89ed5
DA		 562 if (bcmd & (1 << 7))
563 dw_count += (cur_seq->multitex) ? 2 : 1;
564 if (bcmd & (1 << 8))
565 dw_count += (cur_seq->multitex) ? 2 : 1;
566 if (bcmd & (1 << 9))
567 dw_count++;
568 if (bcmd & (1 << 10))
569 dw_count++;
570 if (bcmd & (1 << 11))
571 dw_count++;
572 if (bcmd & (1 << 12))
573 dw_count++;
574 if (bcmd & (1 << 13))
575 dw_count++;
576 if (bcmd & (1 << 14))
577 dw_count++;
578
579 while (buf < buf_end) {
22f579c6 580 if (*buf == a_fire) {
b5e89ed5
DA		 581 if (dev_priv->num_fire_offsets >=
582 VIA_FIRE_BUF_SIZE) {
22f579c6
DA		 583 DRM_ERROR("Fire offset buffer full.\n");
584 ret = 1;
585 break;
586 }
b5e89ed5
DA		 587 dev_priv->fire_offsets[dev_priv->
588 num_fire_offsets++] =
589 buf;
590 have_fire = 1;
22f579c6 591 buf++;
b5e89ed5 592 if (buf < buf_end && *buf == a_fire)
22f579c6
DA		 593 buf++;
594 break;
595 }
b5e89ed5 596 if ((*buf == HALCYON_HEADER2) ||
22f579c6
DA		 597 ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
598 DRM_ERROR("Missing Vertex Fire command, "
599 "Stray Vertex Fire command or verifier "
600 "lost sync.\n");
601 ret = 1;
602 break;
603 }
604 if ((ret = eat_words(&buf, buf_end, dw_count)))
605 break;
606 }
607 if (buf >= buf_end && !have_fire) {
608 DRM_ERROR("Missing Vertex Fire command or verifier "
609 "lost sync.\n");
610 ret = 1;
611 break;
612 }
613 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
614 DRM_ERROR("AGP Primitive list end misaligned.\n");
615 ret = 1;
616 break;
617 }
b5e89ed5 618 }
22f579c6
DA		 619 *buffer = buf;
620 return ret;
621}
622
22f579c6 623static __inline__ verifier_state_t
58c1e85a
NK		 624via_check_header2(uint32_t const **buffer, const uint32_t *buf_end,
625 drm_via_state_t *hc_state)
22f579c6
DA		 626{
627 uint32_t cmd;
628 int hz_mode;
629 hazard_t hz;
630 const uint32_t *buf = *buffer;
631 const hazard_t *hz_table;
632
22f579c6 633 if ((buf_end - buf) < 2) {
b5e89ed5
DA		 634 DRM_ERROR
635 ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
22f579c6
DA		 636 return state_error;
637 }
638 buf++;
639 cmd = (*buf++ & 0xFFFF0000) >> 16;
640
b5e89ed5 641 switch (cmd) {
22f579c6 642 case HC_ParaType_CmdVdata:
b5e89ed5 643 if (via_check_prim_list(&buf, buf_end, hc_state))
22f579c6
DA		 644 return state_error;
645 *buffer = buf;
646 return state_command;
647 case HC_ParaType_NotTex:
648 hz_table = table1;
649 break;
650 case HC_ParaType_Tex:
651 hc_state->texture = 0;
652 hz_table = table2;
653 break;
654 case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
655 hc_state->texture = 1;
656 hz_table = table2;
657 break;
658 case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
659 hz_table = table3;
660 break;
661 case HC_ParaType_Auto:
662 if (eat_words(&buf, buf_end, 2))
663 return state_error;
664 *buffer = buf;
665 return state_command;
666 case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
667 if (eat_words(&buf, buf_end, 32))
668 return state_error;
669 *buffer = buf;
670 return state_command;
671 case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
672 case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
673 DRM_ERROR("Texture palettes are rejected because of "
674 "lack of info how to determine their size.\n");
675 return state_error;
676 case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
677 DRM_ERROR("Fog factor palettes are rejected because of "
678 "lack of info how to determine their size.\n");
679 return state_error;
680 default:
681
682 /*
683 * There are some unimplemented HC_ParaTypes here, that
684 * need to be implemented if the Mesa driver is extended.
685 */
686
687 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
b5e89ed5
DA		 688 "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
689 cmd, *(buf - 2));
22f579c6
DA		 690 *buffer = buf;
691 return state_error;
692 }
693
b5e89ed5 694 while (buf < buf_end) {
22f579c6
DA		 695 cmd = *buf++;
696 if ((hz = hz_table[cmd >> 24])) {
697 if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
698 if (hz_mode == 1) {
699 buf--;
700 break;
701 }
702 return state_error;
703 }
b5e89ed5 704 } else if (hc_state->unfinished &&
22f579c6
DA		 705 finish_current_sequence(hc_state)) {
706 return state_error;
707 }
708 }
58c1e85a 709 if (hc_state->unfinished && finish_current_sequence(hc_state))
22f579c6 710 return state_error;
22f579c6
DA		 711 *buffer = buf;
712 return state_command;
713}
714
715static __inline__ verifier_state_t
58c1e85a
NK		 716via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer,
717 const uint32_t *buf_end, int *fire_count)
22f579c6
DA		 718{
719 uint32_t cmd;
720 const uint32_t *buf = *buffer;
b5e89ed5 721 const uint32_t *next_fire;
22f579c6
DA		 722 int burst = 0;
723
724 next_fire = dev_priv->fire_offsets[*fire_count];
725 buf++;
726 cmd = (*buf & 0xFFFF0000) >> 16;
727 VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
b5e89ed5 728 switch (cmd) {
22f579c6
DA		 729 case HC_ParaType_CmdVdata:
730 while ((buf < buf_end) &&
b5e89ed5
DA		 731 (*fire_count < dev_priv->num_fire_offsets) &&
732 (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
733 while (buf <= next_fire) {
734 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
735 (burst & 63), *buf++);
22f579c6
DA		 736 burst += 4;
737 }
b5e89ed5
DA		 738 if ((buf < buf_end)
739 && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
22f579c6
DA		 740 buf++;
741
b5e89ed5 742 if (++(*fire_count) < dev_priv->num_fire_offsets)
22f579c6
DA		 743 next_fire = dev_priv->fire_offsets[*fire_count];
744 }
745 break;
746 default:
b5e89ed5
DA		 747 while (buf < buf_end) {
748
749 if (*buf == HC_HEADER2 ||
750 (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
751 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
752 (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
753 break;
754
755 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
756 (burst & 63), *buf++);
757 burst += 4;
22f579c6
DA		 758 }
759 }
760 *buffer = buf;
761 return state_command;
762}
763
b5e89ed5 764static __inline__ int verify_mmio_address(uint32_t address)
22f579c6 765{
b5e89ed5 766 if ((address > 0x3FF) && (address < 0xC00)) {
22f579c6
DA		 767 DRM_ERROR("Invalid VIDEO DMA command. "
768 "Attempt to access 3D- or command burst area.\n");
769 return 1;
770 } else if ((address > 0xCFF) && (address < 0x1300)) {
771 DRM_ERROR("Invalid VIDEO DMA command. "
772 "Attempt to access PCI DMA area.\n");
b5e89ed5
DA		 773 return 1;
774 } else if (address > 0x13FF) {
22f579c6
DA		 775 DRM_ERROR("Invalid VIDEO DMA command. "
776 "Attempt to access VGA registers.\n");
777 return 1;
778 }
779 return 0;
780}
781
782static __inline__ int
b5e89ed5
DA		 783verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
784 uint32_t dwords)
22f579c6
DA		 785{
786 const uint32_t *buf = *buffer;
787
788 if (buf_end - buf < dwords) {
789 DRM_ERROR("Illegal termination of video command.\n");
790 return 1;
791 }
792 while (dwords--) {
793 if (*buf++) {
794 DRM_ERROR("Illegal video command tail.\n");
795 return 1;
796 }
797 }
798 *buffer = buf;
799 return 0;
800}
22f579c6
DA		 801
802static __inline__ verifier_state_t
b5e89ed5 803via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 804{
805 uint32_t cmd;
806 const uint32_t *buf = *buffer;
807 verifier_state_t ret = state_command;
808
809 while (buf < buf_end) {
810 cmd = *buf;
811 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
b5e89ed5
DA		 812 (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
813 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 814 break;
815 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
816 "Attempt to access 3D- or command burst area.\n");
817 ret = state_error;
818 break;
819 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
b5e89ed5 820 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
22f579c6
DA		 821 break;
822 DRM_ERROR("Invalid HALCYON_HEADER1 command. "
823 "Attempt to access VGA registers.\n");
824 ret = state_error;
b5e89ed5
DA		 825 break;
826 } else {
22f579c6
DA		 827 buf += 2;
828 }
829 }
830 *buffer = buf;
831 return ret;
832}
833
834static __inline__ verifier_state_t
58c1e85a
NK		 835via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer,
836 const uint32_t *buf_end)
22f579c6
DA		 837{
838 register uint32_t cmd;
839 const uint32_t *buf = *buffer;
840
841 while (buf < buf_end) {
842 cmd = *buf;
b5e89ed5
DA		 843 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
844 break;
845 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
22f579c6
DA		 846 buf++;
847 }
848 *buffer = buf;
849 return state_command;
850}
851
852static __inline__ verifier_state_t
58c1e85a 853via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end)
22f579c6
DA		 854{
855 uint32_t data;
856 const uint32_t *buf = *buffer;
857
858 if (buf_end - buf < 4) {
859 DRM_ERROR("Illegal termination of video header5 command\n");
860 return state_error;
861 }
862
863 data = *buf++ & ~VIA_VIDEOMASK;
864 if (verify_mmio_address(data))
865 return state_error;
866
867 data = *buf++;
868 if (*buf++ != 0x00F50000) {
869 DRM_ERROR("Illegal header5 header data\n");
870 return state_error;
871 }
872 if (*buf++ != 0x00000000) {
873 DRM_ERROR("Illegal header5 header data\n");
874 return state_error;
875 }
b5e89ed5 876 if (eat_words(&buf, buf_end, data))
22f579c6 877 return state_error;
b5e89ed5 878 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
22f579c6
DA		 879 return state_error;
880 *buffer = buf;
881 return state_command;
b5e89ed5
DA		 882
883}
22f579c6
DA		 884
885static __inline__ verifier_state_t
58c1e85a
NK		 886via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer,
887 const uint32_t *buf_end)
22f579c6 888{
b5e89ed5 889 uint32_t addr, count, i;
22f579c6 890 const uint32_t *buf = *buffer;
b5e89ed5 891
22f579c6
DA		 892 addr = *buf++ & ~VIA_VIDEOMASK;
893 i = count = *buf;
894 buf += 3;
58c1e85a 895 while (i--)
22f579c6 896 VIA_WRITE(addr, *buf++);
b5e89ed5
DA		 897 if (count & 3)
898 buf += 4 - (count & 3);
22f579c6 899 *buffer = buf;
b5e89ed5
DA		 900 return state_command;
901}
22f579c6
DA		 902
903static __inline__ verifier_state_t
b5e89ed5 904via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
22f579c6
DA		 905{
906 uint32_t data;
907 const uint32_t *buf = *buffer;
908 uint32_t i;
909
22f579c6
DA		 910 if (buf_end - buf < 4) {
911 DRM_ERROR("Illegal termination of video header6 command\n");
912 return state_error;
913 }
914 buf++;
915 data = *buf++;
916 if (*buf++ != 0x00F60000) {
917 DRM_ERROR("Illegal header6 header data\n");
918 return state_error;
919 }
920 if (*buf++ != 0x00000000) {
921 DRM_ERROR("Illegal header6 header data\n");
922 return state_error;
923 }
924 if ((buf_end - buf) < (data << 1)) {
925 DRM_ERROR("Illegal termination of video header6 command\n");
926 return state_error;
927 }
b5e89ed5 928 for (i = 0; i < data; ++i) {
22f579c6
DA		 929 if (verify_mmio_address(*buf++))
930 return state_error;
931 buf++;
932 }
933 data <<= 1;
934 if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
935 return state_error;
936 *buffer = buf;
937 return state_command;
b5e89ed5 938}
22f579c6
DA		 939
940static __inline__ verifier_state_t
58c1e85a
NK		 941via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer,
942 const uint32_t *buf_end)
22f579c6
DA		 943{
944
b5e89ed5 945 uint32_t addr, count, i;
22f579c6
DA		 946 const uint32_t *buf = *buffer;
947
948 i = count = *++buf;
949 buf += 3;
b5e89ed5 950 while (i--) {
22f579c6
DA		 951 addr = *buf++;
952 VIA_WRITE(addr, *buf++);
953 }
954 count <<= 1;
b5e89ed5
DA		 955 if (count & 3)
956 buf += 4 - (count & 3);
22f579c6
DA		 957 *buffer = buf;
958 return state_command;
b5e89ed5 959}
22f579c6 960
b5e89ed5
DA		 961int
962via_verify_command_stream(const uint32_t * buf, unsigned int size,
84b1fd10 963 struct drm_device * dev, int agp)
22f579c6
DA		 964{
965
966 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
967 drm_via_state_t *hc_state = &dev_priv->hc_state;
968 drm_via_state_t saved_state = *hc_state;
969 uint32_t cmd;
b5e89ed5 970 const uint32_t *buf_end = buf + (size >> 2);
22f579c6 971 verifier_state_t state = state_command;
689692e7
TH		 972 int cme_video;
973 int supported_3d;
974
975 cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
976 dev_priv->chipset == VIA_DX9_0);
977
978 supported_3d = dev_priv->chipset != VIA_DX9_0;
b5e89ed5 979
22f579c6
DA		 980 hc_state->dev = dev;
981 hc_state->unfinished = no_sequence;
982 hc_state->map_cache = NULL;
983 hc_state->agp = agp;
984 hc_state->buf_start = buf;
985 dev_priv->num_fire_offsets = 0;
986
987 while (buf < buf_end) {
988
989 switch (state) {
990 case state_header2:
b5e89ed5 991 state = via_check_header2(&buf, buf_end, hc_state);
22f579c6
DA		 992 break;
993 case state_header1:
b5e89ed5 994 state = via_check_header1(&buf, buf_end);
22f579c6
DA		 995 break;
996 case state_vheader5:
b5e89ed5 997 state = via_check_vheader5(&buf, buf_end);
22f579c6
DA		 998 break;
999 case state_vheader6:
b5e89ed5 1000 state = via_check_vheader6(&buf, buf_end);
22f579c6
DA		 1001 break;
1002 case state_command:
689692e7
TH		 1003 if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1004 supported_3d)
22f579c6 1005 state = state_header2;
b5e89ed5 1006 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6 1007 state = state_header1;
689692e7 1008 else if (cme_video
b5e89ed5 1009 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
22f579c6 1010 state = state_vheader5;
689692e7 1011 else if (cme_video
b5e89ed5 1012 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
22f579c6 1013 state = state_vheader6;
689692e7
TH		 1014 else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1015 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1016 state = state_error;
1017 } else {
b5e89ed5
DA		 1018 DRM_ERROR
1019 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1020 cmd);
22f579c6
DA		 1021 state = state_error;
1022 }
1023 break;
1024 case state_error:
1025 default:
1026 *hc_state = saved_state;
20caafa6 1027 return -EINVAL;
22f579c6 1028 }
b5e89ed5 1029 }
22f579c6
DA		 1030 if (state == state_error) {
1031 *hc_state = saved_state;
20caafa6 1032 return -EINVAL;
22f579c6
DA		 1033 }
1034 return 0;
1035}
1036
b5e89ed5 1037int
58c1e85a 1038via_parse_command_stream(struct drm_device *dev, const uint32_t *buf,
b5e89ed5 1039 unsigned int size)
22f579c6
DA		 1040{
1041
1042 drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1043 uint32_t cmd;
b5e89ed5 1044 const uint32_t *buf_end = buf + (size >> 2);
22f579c6
DA		 1045 verifier_state_t state = state_command;
1046 int fire_count = 0;
b5e89ed5 1047
22f579c6
DA		 1048 while (buf < buf_end) {
1049
1050 switch (state) {
1051 case state_header2:
b5e89ed5
DA		 1052 state =
1053 via_parse_header2(dev_priv, &buf, buf_end,
1054 &fire_count);
22f579c6
DA		 1055 break;
1056 case state_header1:
b5e89ed5 1057 state = via_parse_header1(dev_priv, &buf, buf_end);
22f579c6
DA		 1058 break;
1059 case state_vheader5:
b5e89ed5 1060 state = via_parse_vheader5(dev_priv, &buf, buf_end);
22f579c6
DA		 1061 break;
1062 case state_vheader6:
b5e89ed5 1063 state = via_parse_vheader6(dev_priv, &buf, buf_end);
22f579c6
DA		 1064 break;
1065 case state_command:
b5e89ed5 1066 if (HALCYON_HEADER2 == (cmd = *buf))
22f579c6 1067 state = state_header2;
b5e89ed5 1068 else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
22f579c6
DA		 1069 state = state_header1;
1070 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1071 state = state_vheader5;
1072 else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1073 state = state_vheader6;
1074 else {
b5e89ed5
DA		 1075 DRM_ERROR
1076 ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1077 cmd);
22f579c6
DA		 1078 state = state_error;
1079 }
1080 break;
1081 case state_error:
1082 default:
20caafa6 1083 return -EINVAL;
22f579c6 1084 }
b5e89ed5 1085 }
58c1e85a 1086 if (state == state_error)
20caafa6 1087 return -EINVAL;
22f579c6
DA		 1088 return 0;
1089}
1090
b5e89ed5 1091static void
22f579c6
DA		 1092setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1093{
1094 int i;
1095
58c1e85a 1096 for (i = 0; i < 256; ++i)
22f579c6 1097 table[i] = forbidden_command;
22f579c6 1098
58c1e85a 1099 for (i = 0; i < size; ++i)
22f579c6 1100 table[init_table[i].code] = init_table[i].hz;
22f579c6
DA		 1101}
1102
b5e89ed5 1103void via_init_command_verifier(void)
22f579c6 1104{
b5e89ed5
DA		 1105 setup_hazard_table(init_table1, table1,
1106 sizeof(init_table1) / sizeof(hz_init_t));
1107 setup_hazard_table(init_table2, table2,
1108 sizeof(init_table2) / sizeof(hz_init_t));
1109 setup_hazard_table(init_table3, table3,
1110 sizeof(init_table3) / sizeof(hz_init_t));
22f579c6 1111}
Linux 6.x block layer and io_uring tree(s)