summaryrefslogtreecommitdiff
path: root/linux-core
AgeCommit message (Collapse)Author
2003-04-24Pass dma handle from pci_alloc_consistent to the card for status page,Leif Delgass
rather than using virt_to_bus() on the virtual address.
2003-04-24Remove unused dev->map_count. We always iterate the maplist withLeif Delgass
list_for_each() and the count is not updated or used for stats.
2003-04-24Remove unused variablesLeif Delgass
2003-04-24Move the debug versions of the DRM memory functions to a new file andKeith Whitwell
implement non-debug ones as standard.
2003-04-24Remove #if 0'd code and some unused string functionsKeith Whitwell
2003-04-23Install dummy/noop read & poll fops unless the driver has replacements.Keith Whitwell
2003-04-22Remove AGP dependency in kernel config for radeon, sis. RemoveLeif Delgass
PCIGART_ENABLED define for radeon, pcigart support now included for any arch.
2003-04-22remove unused variableAlan Hourihane
2003-04-22Rename drm_lists.h to gamma_lists.hKeith Whitwell
2003-04-22Move the excitingly named DRM(flush_block_and_flush) and friends toKeith Whitwell
gamma-specific code. Fix templates so i8x0 drivers don't have to define __HAVE_DMA_WAITLIST.
2003-04-22remove unused __HAVE_KERNEL_CTX_SWITCH codeKeith Whitwell
2003-04-22Move a chunk of gamma-specific code out of drm_dma.h. Remove unusedKeith Whitwell
'DRM_FLAG_NOCTX' option.
2003-04-22remove unused dma histogram codeKeith Whitwell
2003-04-22Move a bunch of gamma-specific code into a gamma-specific file. Restore theKeith Whitwell
kooky DRM(write_string) code for gamma.
2003-04-22remove DRM read, poll and write_stringKeith Whitwell
2003-04-21Check for NULL map before calling DRM(ioremapfree) on cleanup. Prevents anLeif Delgass
oops if a map wasn't found (e.g. XFree86 Bugzilla #108)
2003-04-17Add a Kconfig file as used in recent 2.5.x kernels.David Dawes
2003-04-17Make Config.in look more like a recent 2.4.x kernel version.David Dawes
2003-04-17Rework the Linux drm kernel module build to leverage off the standardDavid Dawes
kernel build system. This is based on suggestions and examples from David Woodhouse. This approach has the advantage that the build requirements of a wider range of standard kernels are now supported transparently, but the disadvantage of some extra complexity to handle building against clean vendor-distributed kernel source trees. This has been tested with some recent Red Hat and SuSE distributions.
2003-04-17Bring some drm module changes over from the XFree86 trunk:David Dawes
- Reset 'bound' flag for an agp entry after undbind succeeded in drm_agpsupport.h (Egbert Eich). - Ignore hw_lock for drm device if lock was set by a different instance (ie Xserver) to prevent second server from spinning in driver release function (currently only relevant for i8xx drm drivers) (David Dawes). - Use the agpgart "key" for the unique handle for bindings rather than the memory address (the key is guaranteed to be unique) (David Dawes).
2003-04-17Fix DRM module build on 2.5.41 and later kernels (tqueue -> workqueue).David Dawes
2003-04-08Use list_entry() to get container struct from struct list_head pointers.Leif Delgass
Build fix for RedHat 9 kernel (5 args to remap_page_range()).
2003-04-05add 'SG' map type identifier string (pci scatter/gather) to /proc vm infoLeif Delgass
2003-03-31Warning fix (use %p format for filp)Leif Delgass
2003-03-30Spelling fixes in comments.Eric Anholt
Submitted by: Linus Torvalds <torvalds@transmeta.com>
2003-03-28merged drm-filp-0-1-branchKeith Whitwell
2003-03-26Add 2nd arg for DRM_FREEKeith Whitwell
2003-03-25linux merge for drmAlan Hourihane
2003-03-25XFree86 4.3.0 mergeAlan Hourihane
2003-03-04DRM_FREE/2 patch from Philip BrownKeith Whitwell
2003-02-28Update object targetsLeif Delgass
2003-02-21Merge from bsd-4-0-0-branch.Eric Anholt
2003-02-02don't inflate relative vblank sequence numbers on repeated calls (e.g. whenMichel Daenzer
interrupted by a signal)
2003-01-11limit number of pending vblank signals to 100 to prevent DoS, and minorMichel Daenzer
cleanups
2002-12-12bring in jantorial changes from 2.5.51Keith Whitwell
2002-12-11remove agpgart informationalKeith Whitwell
2002-12-04further vertical blank interrupt cleanups: remove unused variable,Michel Daenzer
non-ambiguous variable names, don't express subtraction in unnecessarily complicated ways
2002-12-03vertical blank interrupt cleanups: use spinlock instead of semaphore, sendMichel Daenzer
signal directly from interrupt handler instead of using a taskqueue (based on feedback by Linus Torvalds)
2002-11-30vertical blank ioctl can send signal instead of blockingMichel Daenzer
2002-10-29updated e-mail addresses for Keith, Alan and JensJens Owen
2002-10-22final part of XFree86 4.2.99.2 mergeAlan Hourihane
2002-10-09replaced max() macro with conditional expressionBrian Paul
2002-10-08Fix error condition...Keith Whitwell
2002-10-08Call pci_enable_device() in DRM(irq_busid).Keith Whitwell
2002-09-29Move os-dependent stuff out of radeon_irq.cKeith Whitwell
2002-09-29add support for 16K and 64K page sizes (Bjorn Helgaas)Michel Daenzer
2002-09-26DRM(vblank_wait) is driver specificMichel Daenzer
2002-09-25common ioctl to wait for vertical blank IRQsMichel Daenzer
2002-09-23merged r200-0-2-branch to trunkKeith Whitwell
2002-09-21make sure we never oops because the hardware lock pointer in the sigdataMichel Daenzer
structure is out of date
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-05 12:22:37 +0000
='n611' href='#n611'>611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 
/*
 * Copyright 2004 The Unichrome Project. All Rights Reserved.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sub license,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice (including the
 * next paragraph) shall be included in all copies or substantial portions
 * of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
 * THE UNICHROME PROJECT, AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 *
 * Author: Thomas Hellström 2004.
 * This code was written using docs obtained under NDA from VIA Inc.
 *
 * Don't run this code directly on an AGP buffer. Due to cache problems it will
 * be very slow.
 */


#include "via_3d_reg.h"
#include "drmP.h"
#include "drm.h"
#include "via_drm.h"
#include "via_verifier.h"
#include "via_drv.h"

typedef enum{
	state_command,
	state_header2,
	state_header1,
	state_vheader5,
	state_vheader6,
	state_error
} verifier_state_t;


typedef enum{
	no_check = 0,
	check_for_header2,
	check_for_header1,
	check_for_header2_err,
	check_for_header1_err,
	check_for_fire,
	check_z_buffer_addr0,
	check_z_buffer_addr1,
	check_z_buffer_addr_mode,
	check_destination_addr0,
	check_destination_addr1,
	check_destination_addr_mode,
	check_for_dummy,
	check_for_dd,
	check_texture_addr0,
	check_texture_addr1,
	check_texture_addr2,
	check_texture_addr3,
	check_texture_addr4,
	check_texture_addr5,
	check_texture_addr6,
	check_texture_addr7,
	check_texture_addr8,
	check_texture_addr_mode,
	check_for_vertex_count,
	check_number_texunits,
	forbidden_command
}hazard_t;

/*
 * Associates each hazard above with a possible multi-command
 * sequence. For example an address that is split over multiple
 * commands and that needs to be checked at the first command 
 * that does not include any part of the address.
 */

static drm_via_sequence_t seqs[] = { 
	no_sequence,
	no_sequence,
	no_sequence,
	no_sequence,
	no_sequence,
	no_sequence,
	z_address,
	z_address,
	z_address,
	dest_address,
	dest_address,
	dest_address,
	no_sequence,
	no_sequence,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	tex_address,
	no_sequence
};
    
typedef struct{
	unsigned int code;
	hazard_t hz;
} hz_init_t;



static hz_init_t init_table1[] = {
	{0xf2, check_for_header2_err},
	{0xf0, check_for_header1_err},
	{0xee, check_for_fire},
	{0xcc, check_for_dummy},
	{0xdd, check_for_dd},
	{0x00, no_check},
	{0x10, check_z_buffer_addr0},
	{0x11, check_z_buffer_addr1},
	{0x12, check_z_buffer_addr_mode},
	{0x13, no_check},
	{0x14, no_check},
	{0x15, no_check},
	{0x23, no_check},
	{0x24, no_check},
	{0x33, no_check},
	{0x34, no_check},
	{0x35, no_check},
	{0x36, no_check},
	{0x37, no_check},
	{0x38, no_check},
	{0x39, no_check},
	{0x3A, no_check},
	{0x3B, no_check},
	{0x3C, no_check},
	{0x3D, no_check},
	{0x3E, no_check},
	{0x40, check_destination_addr0},
	{0x41, check_destination_addr1},
	{0x42, check_destination_addr_mode},
	{0x43, no_check},
	{0x44, no_check},
	{0x50, no_check},
	{0x51, no_check},
	{0x52, no_check},
	{0x53, no_check},
	{0x54, no_check},
	{0x55, no_check},
	{0x56, no_check},
	{0x57, no_check},
	{0x58, no_check},
	{0x70, no_check},
	{0x71, no_check},
	{0x78, no_check},
	{0x79, no_check},
	{0x7A, no_check},
	{0x7B, no_check},
	{0x7C, no_check},
	{0x7D, check_for_vertex_count}
};

   
		       
static hz_init_t init_table2[] = {
	{0xf2, check_for_header2_err},
	{0xf0, check_for_header1_err},
	{0xee, check_for_fire},
	{0xcc, check_for_dummy},
	{0x00, check_texture_addr0},
	{0x01, check_texture_addr0},
	{0x02, check_texture_addr0},
	{0x03, check_texture_addr0},
	{0x04, check_texture_addr0},
	{0x05, check_texture_addr0},
	{0x06, check_texture_addr0},
	{0x07, check_texture_addr0},
	{0x08, check_texture_addr0},
	{0x09, check_texture_addr0},
	{0x20, check_texture_addr1},
	{0x21, check_texture_addr1},
	{0x22, check_texture_addr1},
	{0x23, check_texture_addr4},
	{0x2B, check_texture_addr3},
	{0x2C, check_texture_addr3},
	{0x2D, check_texture_addr3},
	{0x2E, check_texture_addr3},
	{0x2F, check_texture_addr3},
	{0x30, check_texture_addr3},
	{0x31, check_texture_addr3},
	{0x32, check_texture_addr3},
	{0x33, check_texture_addr3},
	{0x34, check_texture_addr3},
	{0x4B, check_texture_addr5},
	{0x4C, check_texture_addr6},
	{0x51, check_texture_addr7},
	{0x52, check_texture_addr8},
	{0x77, check_texture_addr2},
	{0x78, no_check},
	{0x79, no_check},
	{0x7A, no_check},
	{0x7B, check_texture_addr_mode},
	{0x7C, no_check},
	{0x7D, no_check},
	{0x7E, no_check},
	{0x7F, no_check},
	{0x80, no_check},
	{0x81, no_check},
	{0x82, no_check},
	{0x83, no_check},
	{0x85, no_check},
	{0x86, no_check},
	{0x87, no_check},
	{0x88, no_check},
	{0x89, no_check},
	{0x8A, no_check},
	{0x90, no_check},
	{0x91, no_check},
	{0x92, no_check},
	{0x93, no_check}
};

static hz_init_t init_table3[] = {
	{0xf2, check_for_header2_err},
	{0xf0, check_for_header1_err},
	{0xcc, check_for_dummy},
	{0x00, check_number_texunits}
};
   
		       
static hazard_t table1[256]; 
static hazard_t table2[256]; 
static hazard_t table3[256]; 



static __inline__ int
eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
{
	if ((*buf - buf_end) >= num_words) {
		*buf += num_words;
		return 0;
	} 
	DRM_ERROR("Illegal termination of DMA command buffer\n");
	return 1;
}


/*
 * Partially stolen from drm_memory.h
 */

static __inline__ drm_map_t *
via_drm_lookup_agp_map (drm_via_state_t *seq, unsigned long offset, unsigned long size, 
			drm_device_t *dev)
{
	struct list_head *list;
	drm_map_list_t *r_list;
	drm_map_t *map = seq->map_cache;

	if (map && map->offset <= offset && (offset + size) <= (map->offset + map->size)) {
		return map;
	}
		
	list_for_each(list, &dev->maplist->head) {
		r_list = (drm_map_list_t *) list;
		map = r_list->map;
		if (!map)
			continue;
		if (map->offset <= offset && (offset + size) <= (map->offset + map->size) && 
		    !(map->flags & _DRM_RESTRICTED) && (map->type == _DRM_AGP)) {
			seq->map_cache = map;
			return map;
		}
	}
	return NULL;
}


/*
 * Require that all AGP texture levels reside in the same AGP map which should 
 * be mappable by the client. This is not a big restriction.
 * FIXME: To actually enforce this security policy strictly, drm_rmmap 
 * would have to wait for dma quiescent before removing an AGP map. 
 * The via_drm_lookup_agp_map call in reality seems to take
 * very little CPU time.
 */


static __inline__ int
finish_current_sequence(drm_via_state_t *cur_seq) 
{
	switch(cur_seq->unfinished) {
	case z_address:
		DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
		break;
	case dest_address:
		DRM_DEBUG("Destination start address is 0x%x\n", cur_seq->d_addr);
		break;
	case tex_address:
		if (cur_seq->agp_texture) {			 
			unsigned start = cur_seq->tex_level_lo[cur_seq->texture];
			unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
			unsigned long lo=~0, hi=0, tmp;
			uint32_t *addr, *pitch, *height, tex;
			unsigned i;

			if (end > 9) end = 9;
			if (start > 9) start = 9;

			addr =&(cur_seq->t_addr[tex = cur_seq->texture][start]);
			pitch = &(cur_seq->pitch[tex][start]);
			height = &(cur_seq->height[tex][start]);

			for (i=start; i<= end; ++i) {
				tmp = *addr++;
				if (tmp < lo) lo = tmp;
				tmp += (*height++ << *pitch++);
				if (tmp > hi) hi = tmp;
			}

			if (! via_drm_lookup_agp_map (cur_seq, lo, hi - lo, cur_seq->dev)) {
				DRM_ERROR("AGP texture is not in allowed map\n");
				return 2;
			}
		}	
		break;
	default:
		break;
	}
	cur_seq->unfinished = no_sequence;
	return 0;
}

static __inline__ int 
investigate_hazard( uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
{
	register uint32_t tmp, *tmp_addr;

	if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
		int ret;
		if ((ret = finish_current_sequence(cur_seq))) return ret;
	}

	switch(hz) {
	case check_for_header2:
		if (cmd == HALCYON_HEADER2) return 1;
		return 0;
	case check_for_header1:
		if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) return 1;
		return 0;
	case check_for_header2_err:
		if (cmd == HALCYON_HEADER2) return 1;
		DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
		break;
	case check_for_header1_err:
		if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) return 1;
		DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
		break;
	case check_for_fire:
		if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD) return 1; 
		DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
		break;
	case check_for_dummy:
		if (HC_DUMMY == cmd) return 0;
		DRM_ERROR("Illegal DMA HC_DUMMY command\n");
		break;
	case check_for_dd:
		if (0xdddddddd == cmd) return 0;
		DRM_ERROR("Illegal DMA 0xdddddddd command\n");
		break;
	case check_z_buffer_addr0:
		cur_seq->unfinished = z_address;
		cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
			(cmd & 0x00FFFFFF);
		return 0;
	case check_z_buffer_addr1:
		cur_seq->unfinished = z_address;
		cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
			((cmd & 0xFF) << 24);
		return 0;
	case check_z_buffer_addr_mode:
		cur_seq->unfinished = z_address;
		if ((cmd & 0x0000C000) == 0) return 0;
		DRM_ERROR("Attempt to place Z buffer in system memory\n");
		return 2;
	case check_destination_addr0:
		cur_seq->unfinished = dest_address;
		cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
			(cmd & 0x00FFFFFF);
		return 0;
	case check_destination_addr1:
		cur_seq->unfinished = dest_address;
		cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
			((cmd & 0xFF) << 24);
		return 0;
	case check_destination_addr_mode:
		cur_seq->unfinished = dest_address;
		if ((cmd & 0x0000C000) == 0) return 0;
		DRM_ERROR("Attempt to place 3D drawing buffer in system memory\n");
		return 2;	    
	case check_texture_addr0:
		cur_seq->unfinished = tex_address;
		tmp = (cmd >> 24);
		tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
		*tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
		return 0;
	case check_texture_addr1:
		cur_seq->unfinished = tex_address;
		tmp = ((cmd >> 24) - 0x20);
		tmp += tmp << 1;
		tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
		tmp_addr++;
		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
		tmp_addr++;
		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
		return 0;
	case check_texture_addr2:
		cur_seq->unfinished = tex_address;
		cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
		cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
		return 0;
	case check_texture_addr3:
		cur_seq->unfinished = tex_address;
		tmp = ((cmd >> 24) - 0x2B);
		cur_seq->pitch[cur_seq->texture][tmp] = (cmd & 0x00F00000) >> 20;
		if (!tmp && (cmd & 0x000FFFFF)) {
			DRM_ERROR("Unimplemented texture level 0 pitch mode.\n");
			return 2;
		}
		return 0;
	case check_texture_addr4:
		cur_seq->unfinished = tex_address;
		tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
		return 0;
	case check_texture_addr5:
	case check_texture_addr6:
		cur_seq->unfinished = tex_address;
		/*
		 * Texture width. We don't care since we have the pitch.
		 */  
		return 0;
	case check_texture_addr7:
		cur_seq->unfinished = tex_address;
		tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
		tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
		tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
		tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
		tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
		tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
		tmp_addr[0] = 1 << (cmd & 0x0000000F);
		return 0;
	case check_texture_addr8:
		cur_seq->unfinished = tex_address;
		tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
		tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
	        tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
		tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
		tmp_addr[6] = 1 << (cmd & 0x0000000F);
		return 0;
	case check_texture_addr_mode:
		cur_seq->unfinished = tex_address;
		if ( 2 == (tmp = cmd & 0x00000003)) {
			DRM_ERROR("Attempt to fetch texture from system memory.\n"); 
			return 2;
		}
		cur_seq->agp_texture = (tmp == 3);
		cur_seq->tex_palette_size[cur_seq->texture] = 
			(cmd >> 16) & 0x000000007;
		return 0;
	case check_for_vertex_count:
		cur_seq->vertex_count = cmd & 0x0000FFFF;
		return 0;
	case check_number_texunits:
	        cur_seq->multitex = (cmd >> 3) & 1;
		return 0;
	default:
		DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
		return 2;
	}
	return 2;
}


static __inline__ int
via_check_prim_list(uint32_t const **buffer, const uint32_t *buf_end,
		    drm_via_state_t *cur_seq)
{
	drm_via_private_t *dev_priv = (drm_via_private_t *) cur_seq->dev->dev_private;
	uint32_t a_fire, bcmd , dw_count;
	int ret = 0;
	int have_fire;
	const uint32_t *buf = *buffer;

	while(buf < buf_end) {
	        have_fire = 0;
		if ((buf_end - buf) < 2) {
			DRM_ERROR("Unexpected termination of primitive list.\n");
			ret = 1;
			break;
		}
		if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB) break;
		bcmd = *buf++;
		if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
			DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
				  *buf);
			ret = 1;
			break;
		}
		a_fire = *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK | HC_HE3Fire_MASK;	
	
		/*
		 * How many dwords per vertex ?
		 */ 
		
		if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
			DRM_ERROR("Illegal B command vertex data for AGP.\n");
			ret = 1;
			break;
		} 

		dw_count = 0;
		if (bcmd & (1 << 7)) dw_count += (cur_seq->multitex) ? 2:1;
		if (bcmd & (1 << 8)) dw_count += (cur_seq->multitex) ? 2:1;
		if (bcmd & (1 << 9)) dw_count++;
		if (bcmd & (1 << 10)) dw_count++;
		if (bcmd & (1 << 11)) dw_count++;
		if (bcmd & (1 << 12)) dw_count++;
		if (bcmd & (1 << 13)) dw_count++;
		if (bcmd & (1 << 14)) dw_count++;

		while(buf < buf_end) {
			if (*buf == a_fire) {
				if (dev_priv->num_fire_offsets >= VIA_FIRE_BUF_SIZE) {
					DRM_ERROR("Fire offset buffer full.\n");
					ret = 1;
					break;
				}
				dev_priv->fire_offsets[dev_priv->num_fire_offsets++] = buf;
			        have_fire = 1;
				buf++;
				if (buf < buf_end && *buf == a_fire) 
					buf++;
				break;
			}
			if ((*buf == HALCYON_HEADER2) || 
			    ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
				DRM_ERROR("Missing Vertex Fire command, "
					  "Stray Vertex Fire command  or verifier "
					  "lost sync.\n");
				ret = 1;
				break;
			}
			if ((ret = eat_words(&buf, buf_end, dw_count)))
				break;
		}
		if (buf >= buf_end && !have_fire) {
			DRM_ERROR("Missing Vertex Fire command or verifier "
				  "lost sync.\n");
			ret = 1;
			break;
		}
		if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
			DRM_ERROR("AGP Primitive list end misaligned.\n");
			ret = 1;
			break;
		}
	} 
	*buffer = buf;
	return ret;
}


		       


static __inline__ verifier_state_t
via_check_header2( uint32_t const **buffer, const uint32_t *buf_end, 
		   drm_via_state_t *hc_state)
{
	uint32_t cmd;
	int hz_mode;
	hazard_t hz;
	const uint32_t *buf = *buffer;
	const hazard_t *hz_table;


	if ((buf_end - buf) < 2) {
		DRM_ERROR("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
		return state_error;
	}
	buf++;
	cmd = (*buf++ & 0xFFFF0000) >> 16;

	switch(cmd) {