summaryrefslogtreecommitdiff
path: root/linux-core/drm_stub.c
blob: 5496ed89fba2a6a24bb6fcc818999388c6e81675 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
/**
 * \file drm_stub.c
 * Stub support
 *
 * \author Rickard E. (Rik) Faith <faith@valinux.com>
 */

/*
 * Created: Fri Jan 19 10:48:35 2001 by faith@acm.org
 *
 * Copyright 2001 VA Linux Systems, Inc., Sunnyvale, California.
 * All Rights Reserved.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice (including the next
 * paragraph) shall be included in all copies or substantial portions of the
 * Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
 * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */

#include <linux/module.h>
#include <linux/moduleparam.h>

#include "drmP.h"
#include "drm_core.h"

unsigned int cards_limit = 16;	/* Enough for one machine */
unsigned int drm_debug = 0;		/* 1 to enable debug output */
EXPORT_SYMBOL(drm_debug);

MODULE_AUTHOR(CORE_AUTHOR);
MODULE_DESCRIPTION(CORE_DESC);
MODULE_LICENSE("GPL and additional rights");
MODULE_PARM_DESC(cards_limit, "Maximum number of graphics cards");
MODULE_PARM_DESC(debug, "Enable debug output");

module_param(cards_limit, int, S_IRUGO);
module_param_named(debug, drm_debug, int, S_IRUGO|S_IWUGO);

drm_head_t **drm_heads;
struct drm_sysfs_class *drm_class;
struct proc_dir_entry *drm_proc_root;

static int fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
		       const struct pci_device_id *ent,
		       struct drm_driver *driver)
{
	int retcode;

	spin_lock_init(&dev->count_lock);
	init_timer(&dev->timer);
	sema_init(&dev->struct_sem, 1);
	sema_init(&dev->ctxlist_sem, 1);

	dev->pdev = pdev;

#ifdef __alpha__
	dev->hose = pdev->sysdata;
	dev->pci_domain = dev->hose->bus->number;
#else
	dev->pci_domain = 0;
#endif
	dev->pci_bus = pdev->bus->number;
	dev->pci_slot = PCI_SLOT(pdev->devfn);
	dev->pci_func = PCI_FUNC(pdev->devfn);
	dev->irq = pdev->irq;

	dev->maplist = drm_calloc(1, sizeof(*dev->maplist), DRM_MEM_MAPS);
	if (dev->maplist == NULL)
		return -ENOMEM;
	INIT_LIST_HEAD(&dev->maplist->head);

	/* the DRM has 6 counters */
	dev->counters = 6;
	dev->types[0] = _DRM_STAT_LOCK;
	dev->types[1] = _DRM_STAT_OPENS;
	dev->types[2] = _DRM_STAT_CLOSES;
	dev->types[3] = _DRM_STAT_IOCTLS;
	dev->types[4] = _DRM_STAT_LOCKS;
	dev->types[5] = _DRM_STAT_UNLOCKS;

	dev->driver = driver;

	if (dev->driver->preinit)
		if ((retcode = dev->driver->preinit(dev, ent->driver_data)))
			goto error_out_unreg;

	if (drm_core_has_AGP(dev)) {
		if (drm_device_is_agp(dev))
			dev->agp = drm_agp_init(dev);
		if (drm_core_check_feature(dev, DRIVER_REQUIRE_AGP)
		    && (dev->agp == NULL)) {
			DRM_ERROR("Cannot initialize the agpgart module.\n");
			retcode = -EINVAL;
			goto error_out_unreg;
		}

		if (drm_core_has_MTRR(dev)) {
			if (dev->agp)
				dev->agp->agp_mtrr =
				    mtrr_add(dev->agp->agp_info.aper_base,
					     dev->agp->agp_info.aper_size *
					     1024 * 1024, MTRR_TYPE_WRCOMB, 1);
		}
	}

	retcode = drm_ctxbitmap_init(dev);
	if (retcode) {
		DRM_ERROR("Cannot allocate memory for context bitmap.\n");
		goto error_out_unreg;
	}

	return 0;

error_out_unreg:
	drm_takedown(dev);
	return retcode;
}

/**
 * Get a secondary minor number.
 *
 * \param dev device data structure
 * \param sec-minor structure to hold the assigned minor
 * \return negative number on failure.
 *
 * Search an empty entry and initialize it to the given parameters, and
 * create the proc init entry via proc_init(). This routines assigns
 * minor numbers to secondary heads of multi-headed cards
 */
static int drm_get_head(drm_device_t * dev, drm_head_t * head)
{
	drm_head_t **heads = drm_heads;
	int ret;
	int minor;

	DRM_DEBUG("\n");

	for (minor = 0; minor < cards_limit; minor++, heads++) {
		if (!*heads) {

			*head = (drm_head_t) {
				.dev = dev,
				.device = MKDEV(DRM_MAJOR, minor),
				.minor = minor,
			};
			if ((ret =
			     drm_proc_init(dev, minor, drm_proc_root,
					   &head->dev_root))) {
				printk(KERN_ERR
				       "DRM: Failed to initialize /proc/dri.\n");
				goto err_g1;
			}

			head->dev_class = drm_sysfs_device_add(drm_class, head);
			if (IS_ERR(head->dev_class)) {
				printk(KERN_ERR
				       "DRM: Error sysfs_device_add.\n");
				ret = PTR_ERR(head->dev_class);
				goto err_g2;
			}
			*heads = head;

			DRM_DEBUG("new minor assigned %d\n", minor);
			return 0;
		}
	}
	DRM_ERROR("out of minors\n");
	return -ENOMEM;
err_g2:
	drm_proc_cleanup(minor, drm_proc_root, head->dev_root);
err_g1:
	*head = (drm_head_t) {
		.dev = NULL};
	return ret;
}

/**
 * Register.
 *
 * \param pdev - PCI device structure
 * \param ent entry from the PCI ID table with device type flags
 * \return zero on success or a negative number on failure.
 *
 * Attempt to gets inter module "drm" information. If we are first
 * then register the character device and inter module information.
 * Try and register, if we fail to register, backout previous work.
 */
int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
	      struct drm_driver *driver)
{
	drm_device_t *dev;
	int ret;

	DRM_DEBUG("\n");

	dev = drm_calloc(1, sizeof(*dev), DRM_MEM_STUB);
	if (!dev)
		return -ENOMEM;

	if (!drm_fb_loaded) {
		pci_set_drvdata(pdev, dev);
		pci_request_regions(pdev, driver->pci_driver.name);
		pci_enable_device(pdev);
	}
	if ((ret = fill_in_dev(dev, pdev, ent, driver))) {
		goto err_g1;
	}
	if ((ret = drm_get_head(dev, &dev->primary)))
		goto err_g1;

	/* postinit is a required function to display the signon banner */
	/* drivers add secondary heads here if needed */
	if ((ret = dev->driver->postinit(dev, ent->driver_data)))
		goto err_g2;

	return 0;

err_g2:
	drm_put_head(&dev->primary);
err_g1:
	if (!drm_fb_loaded) {
		pci_set_drvdata(pdev, NULL);
		pci_release_regions(pdev);
		pci_disable_device(pdev);
	}
	drm_free(dev, sizeof(*dev), DRM_MEM_STUB);
	printk(KERN_ERR "DRM: drm_get_dev failed.\n");
	return ret;
}
EXPORT_SYMBOL(drm_get_dev);


/**
 * Put a device minor number.
 *
 * \param dev device data structure
 * \return always zero
 *
 * Cleans up the proc resources. If it is the last minor then release the foreign
 * "drm" data, otherwise unregisters the "drm" data, frees the dev list and
 * unregisters the character device.
 */
int drm_put_dev(drm_device_t * dev)
{
	DRM_DEBUG("release primary %s\n", dev->driver->pci_driver.name);

	if (dev->unique) {
		drm_free(dev->unique, strlen(dev->unique) + 1, DRM_MEM_DRIVER);
		dev->unique = NULL;
		dev->unique_len = 0;
	}
	if (dev->devname) {
		drm_free(dev->devname, strlen(dev->devname) + 1,
			 DRM_MEM_DRIVER);
		dev->devname = NULL;
	}
	drm_free(dev, sizeof(*dev), DRM_MEM_STUB);
	return 0;
}

/**
 * Put a secondary minor number.
 *
 * \param sec_minor - structure to be released
 * \return always zero
 *
 * Cleans up the proc resources. Not legal for this to be the
 * last minor released.
 *
 */
int drm_put_head(drm_head_t * head)
{
	int minor = head->minor;

	DRM_DEBUG("release secondary minor %d\n", minor);

	drm_proc_cleanup(minor, drm_proc_root, head->dev_root);
	drm_sysfs_device_remove(head->dev_class);

	*head = (drm_head_t){.dev = NULL};

	drm_heads[minor] = NULL;
	return 0;
}
n>, no_check}, {0x3C, no_check}, {0x3D, no_check}, {0x3E, no_check}, {0x40, check_destination_addr0}, {0x41, check_destination_addr1}, {0x42, check_destination_addr_mode}, {0x43, no_check}, {0x44, no_check}, {0x50, no_check}, {0x51, no_check}, {0x52, no_check}, {0x53, no_check}, {0x54, no_check}, {0x55, no_check}, {0x56, no_check}, {0x57, no_check}, {0x58, no_check}, {0x70, no_check}, {0x71, no_check}, {0x78, no_check}, {0x79, no_check}, {0x7A, no_check}, {0x7B, no_check}, {0x7C, no_check}, {0x7D, check_for_vertex_count} }; static hz_init_t init_table2[] = { {0xf2, check_for_header2_err}, {0xf0, check_for_header1_err}, {0xee, check_for_fire}, {0xcc, check_for_dummy}, {0x00, check_texture_addr0}, {0x01, check_texture_addr0}, {0x02, check_texture_addr0}, {0x03, check_texture_addr0}, {0x04, check_texture_addr0}, {0x05, check_texture_addr0}, {0x06, check_texture_addr0}, {0x07, check_texture_addr0}, {0x08, check_texture_addr0}, {0x09, check_texture_addr0}, {0x20, check_texture_addr1}, {0x21, check_texture_addr1}, {0x22, check_texture_addr1}, {0x23, check_texture_addr4}, {0x2B, check_texture_addr3}, {0x2C, check_texture_addr3}, {0x2D, check_texture_addr3}, {0x2E, check_texture_addr3}, {0x2F, check_texture_addr3}, {0x30, check_texture_addr3}, {0x31, check_texture_addr3}, {0x32, check_texture_addr3}, {0x33, check_texture_addr3}, {0x34, check_texture_addr3}, {0x4B, check_texture_addr5}, {0x4C, check_texture_addr6}, {0x51, check_texture_addr7}, {0x52, check_texture_addr8}, {0x77, check_texture_addr2}, {0x78, no_check}, {0x79, no_check}, {0x7A, no_check}, {0x7B, check_texture_addr_mode}, {0x7C, no_check}, {0x7D, no_check}, {0x7E, no_check}, {0x7F, no_check}, {0x80, no_check}, {0x81, no_check}, {0x82, no_check}, {0x83, no_check}, {0x85, no_check}, {0x86, no_check}, {0x87, no_check}, {0x88, no_check}, {0x89, no_check}, {0x8A, no_check}, {0x90, no_check}, {0x91, no_check}, {0x92, no_check}, {0x93, no_check} }; static hz_init_t init_table3[] = { {0xf2, check_for_header2_err}, {0xf0, check_for_header1_err}, {0xcc, check_for_dummy}, {0x00, check_number_texunits} }; static hazard_t table1[256]; static hazard_t table2[256]; static hazard_t table3[256]; static __inline__ int eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words) { if ((*buf - buf_end) >= num_words) { *buf += num_words; return 0; } DRM_ERROR("Illegal termination of DMA command buffer\n"); return 1; } /* * Partially stolen from drm_memory.h */ static __inline__ drm_map_t * via_drm_lookup_agp_map (drm_via_state_t *seq, unsigned long offset, unsigned long size, drm_device_t *dev) { struct list_head *list; drm_map_list_t *r_list; drm_map_t *map = seq->map_cache; if (map && map->offset <= offset && (offset + size) <= (map->offset + map->size)) { return map; } list_for_each(list, &dev->maplist->head) { r_list = (drm_map_list_t *) list; map = r_list->map; if (!map) continue; if (map->offset <= offset && (offset + size) <= (map->offset + map->size) && !(map->flags & _DRM_RESTRICTED) && (map->type == _DRM_AGP)) { seq->map_cache = map; return map; } } return NULL; } /* * Require that all AGP texture levels reside in the same AGP map which should * be mappable by the client. This is not a big restriction. * FIXME: To actually enforce this security policy strictly, drm_rmmap * would have to wait for dma quiescent before removing an AGP map. * The via_drm_lookup_agp_map call in reality seems to take * very little CPU time. */ static __inline__ int finish_current_sequence(drm_via_state_t *cur_seq) { switch(cur_seq->unfinished) { case z_address: DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr); break; case dest_address: DRM_DEBUG("Destination start address is 0x%x\n", cur_seq->d_addr); break; case tex_address: if (cur_seq->agp_texture) { unsigned start = cur_seq->tex_level_lo[cur_seq->texture]; unsigned end = cur_seq->tex_level_hi[cur_seq->texture]; unsigned long lo=~0, hi=0, tmp; uint32_t *addr, *pitch, *height, tex; unsigned i; if (end > 9) end = 9; if (start > 9) start = 9; addr =&(cur_seq->t_addr[tex = cur_seq->texture][start]); pitch = &(cur_seq->pitch[tex][start]); height = &(cur_seq->height[tex][start]); for (i=start; i<= end; ++i) { tmp = *addr++; if (tmp < lo) lo = tmp; tmp += (*height++ << *pitch++); if (tmp > hi) hi = tmp; } if (! via_drm_lookup_agp_map (cur_seq, lo, hi - lo, cur_seq->dev)) { DRM_ERROR("AGP texture is not in allowed map\n"); return 2; } } break; default: break; } cur_seq->unfinished = no_sequence; return 0; } static __inline__ int investigate_hazard( uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq) { register uint32_t tmp, *tmp_addr; if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) { int ret; if ((ret = finish_current_sequence(cur_seq))) return ret; } switch(hz) { case check_for_header2: if (cmd == HALCYON_HEADER2) return 1; return 0; case check_for_header1: if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) return 1; return 0; case check_for_header2_err: if (cmd == HALCYON_HEADER2) return 1; DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n"); break; case check_for_header1_err: if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) return 1; DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n"); break; case check_for_fire: if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD) return 1; DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n"); break; case check_for_dummy: if (HC_DUMMY == cmd) return 0; DRM_ERROR("Illegal DMA HC_DUMMY command\n"); break; case check_for_dd: if (0xdddddddd == cmd) return 0; DRM_ERROR("Illegal DMA 0xdddddddd command\n"); break; case check_z_buffer_addr0: cur_seq->unfinished = z_address; cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) | (cmd & 0x00FFFFFF); return 0; case check_z_buffer_addr1: cur_seq->unfinished = z_address; cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); return 0; case check_z_buffer_addr_mode: cur_seq->unfinished = z_address; if ((cmd & 0x0000C000) == 0) return 0; DRM_ERROR("Attempt to place Z buffer in system memory\n"); return 2; case check_destination_addr0: cur_seq->unfinished = dest_address; cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) | (cmd & 0x00FFFFFF); return 0; case check_destination_addr1: cur_seq->unfinished = dest_address; cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); return 0; case check_destination_addr_mode: cur_seq->unfinished = dest_address; if ((cmd & 0x0000C000) == 0) return 0; DRM_ERROR("Attempt to place 3D drawing buffer in system memory\n"); return 2; case check_texture_addr0: cur_seq->unfinished = tex_address; tmp = (cmd >> 24); tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF); return 0; case check_texture_addr1: cur_seq->unfinished = tex_address; tmp = ((cmd >> 24) - 0x20); tmp += tmp << 1; tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp]; *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); tmp_addr++; *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16); tmp_addr++; *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8); return 0; case check_texture_addr2: cur_seq->unfinished = tex_address; cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F; cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6; return 0; case check_texture_addr3: cur_seq->unfinished = tex_address; tmp = ((cmd >> 24) - 0x2B); cur_seq->pitch[cur_seq->texture][tmp] = (cmd & 0x00F00000) >> 20; if (!tmp && (cmd & 0x000FFFFF)) { DRM_ERROR("Unimplemented texture level 0 pitch mode.\n"); return 2; } return 0; case check_texture_addr4: cur_seq->unfinished = tex_address; tmp_addr = &cur_seq->t_addr[cur_seq->texture][9]; *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24); return 0; case check_texture_addr5: case check_texture_addr6: cur_seq->unfinished = tex_address; /* * Texture width. We don't care since we have the pitch. */ return 0; case check_texture_addr7: cur_seq->unfinished = tex_address; tmp_addr = &(cur_seq->height[cur_seq->texture][0]); tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20); tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16); tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12); tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8); tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4); tmp_addr[0] = 1 << (cmd & 0x0000000F); return 0; case check_texture_addr8: cur_seq->unfinished = tex_address; tmp_addr = &(cur_seq->height[cur_seq->texture][0]); tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12); tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8); tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4); tmp_addr[6] = 1 << (cmd & 0x0000000F); return 0; case check_texture_addr_mode: cur_seq->unfinished = tex_address; if ( 2 == (tmp = cmd & 0x00000003)) { DRM_ERROR("Attempt to fetch texture from system memory.\n"); return 2; } cur_seq->agp_texture = (tmp == 3); cur_seq->tex_palette_size[cur_seq->texture] = (cmd >> 16) & 0x000000007; return 0; case check_for_vertex_count: cur_seq->vertex_count = cmd & 0x0000FFFF; return 0; case check_number_texunits: cur_seq->multitex = (cmd >> 3) & 1; return 0; default: DRM_ERROR("Illegal DMA data: 0x%x\n", cmd); return 2; } return 2; } static __inline__ int via_check_prim_list(uint32_t const **buffer, const uint32_t *buf_end, drm_via_state_t *cur_seq) { uint32_t a_fire, bcmd , dw_count; int ret = 0; int have_fire; const uint32_t *buf = *buffer; while(buf < buf_end) { have_fire = 0; if ((buf_end - buf) < 2) { DRM_ERROR("Unexpected termination of primitive list.\n"); ret = 1; break; } if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB) break; bcmd = *buf++; if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) { DRM_ERROR("Expected Vertex List A command, got 0x%x\n", *buf); ret = 1; break; } a_fire = *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK | HC_HE3Fire_MASK; /* * How many dwords per vertex ? */ if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) { DRM_ERROR("Illegal B command vertex data for AGP.\n"); ret = 1; break; } dw_count = 0; if (bcmd & (1 << 7)) dw_count += (cur_seq->multitex) ? 2:1; if (bcmd & (1 << 8)) dw_count += (cur_seq->multitex) ? 2:1; if (bcmd & (1 << 9)) dw_count++; if (bcmd & (1 << 10)) dw_count++; if (bcmd & (1 << 11)) dw_count++; if (bcmd & (1 << 12)) dw_count++; if (bcmd & (1 << 13)) dw_count++; if (bcmd & (1 << 14)) dw_count++; while(buf < buf_end) { if (*buf == a_fire) { have_fire = 1; buf++; if (buf < buf_end && *buf == a_fire) buf++; break; } if ((*buf == HALCYON_HEADER2) || ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) { DRM_ERROR("Missing Vertex Fire command, " "Stray Vertex Fire command or verifier " "lost sync.\n"); ret = 1; break; } if ((ret = eat_words(&buf, buf_end, dw_count))) break; } if (buf >= buf_end && !have_fire) { DRM_ERROR("Missing Vertex Fire command or verifier " "lost sync.\n"); ret = 1; break; } if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) { DRM_ERROR("AGP Primitive list end misaligned.\n"); ret = 1; break; } } *buffer = buf; return ret; } static __inline__ verifier_state_t via_check_header2( uint32_t const **buffer, const uint32_t *buf_end, drm_via_state_t *hc_state) { uint32_t cmd; int hz_mode; hazard_t hz; const uint32_t *buf = *buffer; const hazard_t *hz_table; if ((buf_end - buf) < 2) { DRM_ERROR("Illegal termination of DMA HALCYON_HEADER2 sequence.\n"); return state_error; } buf++; cmd = (*buf++ & 0xFFFF0000) >> 16; switch(cmd) { case HC_ParaType_CmdVdata: if (via_check_prim_list(&buf, buf_end, hc_state )) return state_error; *buffer = buf; return state_command; case HC_ParaType_NotTex: hz_table = table1; break; case HC_ParaType_Tex: hc_state->texture = 0; hz_table = table2; break; case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)): hc_state->texture = 1; hz_table = table2; break; case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)): hz_table = table3; break; case HC_ParaType_Auto: if (eat_words(&buf, buf_end, 2)) return state_error; *buffer = buf; return state_command; case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)): if (eat_words(&buf, buf_end, 32)) return state_error; *buffer = buf; return state_command; case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)): case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)): DRM_ERROR("Texture palettes are rejected because of " "lack of info how to determine their size.\n"); return state_error; case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)): DRM_ERROR("Fog factor palettes are rejected because of " "lack of info how to determine their size.\n"); return state_error; default: /* * There are some unimplemented HC_ParaTypes here, that * need to be implemented if the Mesa driver is extended. */ DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 " "DMA subcommand: 0x%x. Previous dword: 0x%x\n", cmd, *(buf -2)); *buffer = buf; return state_error; } while(buf < buf_end) { cmd = *buf++; if ((hz = hz_table[cmd >> 24])) { if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) { if (hz_mode == 1) { buf--; break; } return state_error; } } else if (hc_state->unfinished && finish_current_sequence(hc_state)) { return state_error; } } if (hc_state->unfinished && finish_current_sequence(hc_state)) { return state_error; } *buffer = buf; return state_command; } static __inline__ int verify_mmio_address( uint32_t address) { if ((address > 0x3FF) && (address < 0xC00 )) { DRM_ERROR("Invalid HALCYON_HEADER1 command. " "Attempt to access 3D- or command burst area.\n"); return 1; } else if (address > 0xCFF ) { DRM_ERROR("Invalid HALCYON_HEADER1 command. " "Attempt to access VGA registers.\n"); return 1; } return 0; } static __inline__ int verify_video_tail( uint32_t const **buffer, const uint32_t *buf_end, uint32_t dwords) { const uint32_t *buf = *buffer; if (buf_end - buf < dwords) { DRM_ERROR("Illegal termination of video command.\n"); return 1; } while (dwords--) { if (*buf++) { DRM_ERROR("Illegal video command tail.\n"); return 1; } } *buffer = buf; return 0; } static __inline__ verifier_state_t via_check_header1( uint32_t const **buffer, const uint32_t *buf_end ) { uint32_t cmd; const uint32_t *buf = *buffer; verifier_state_t ret = state_command; while (buf < buf_end) { cmd = *buf; if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) && (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) { if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) break; DRM_ERROR("Invalid HALCYON_HEADER1 command. " "Attempt to access 3D- or command burst area.\n"); ret = state_error; break; } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) { if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1) break; DRM_ERROR("Invalid HALCYON_HEADER1 command. " "Attempt to access VGA registers.\n"); ret = state_error; break; } else { buf += 2; } } *buffer = buf; return ret; } static __inline__ verifier_state_t via_check_vheader5( uint32_t const **buffer, const uint32_t *buf_end ) { uint32_t data; const uint32_t *buf = *buffer; if (buf_end - buf < 4) { DRM_ERROR("Illegal termination of video header5 command\n"); return state_error; } data = *buf++ & ~VIA_VIDEOMASK; if (verify_mmio_address(data)) return state_error; data = *buf++; if (*buf++ != 0x00F50000) { DRM_ERROR("Illegal header5 header data\n"); return state_error; } if (*buf++ != 0x00000000) { DRM_ERROR("Illegal header5 header data\n"); return state_error; } if (eat_words(&buf, buf_end, data)) return state_error; if (verify_video_tail(&buf, buf_end, 4 - (data & 3))) return state_error; *buffer = buf; return state_command; } static __inline__ verifier_state_t via_check_vheader6( uint32_t const **buffer, const uint32_t *buf_end ) { uint32_t data; const uint32_t *buf = *buffer; uint32_t i; DRM_ERROR("H6\n"); if (buf_end - buf < 4) { DRM_ERROR("Illegal termination of video header6 command\n"); return state_error; } data = *buf++; if (*buf++ != 0x00F60000) { DRM_ERROR("Illegal header6 header data\n"); return state_error; } if (*buf++ != 0x00000000) { DRM_ERROR("Illegal header6 header data\n"); return state_error; } if ((buf_end - buf) < (data << 1)) { DRM_ERROR("Illegal termination of video header6 command\n"); } for (i=0; i<data; ++i) { if (verify_mmio_address(*buf++)) return state_error; buf++; } if (verify_video_tail(&buf, buf_end, 4 - ((data << 1) & 3))) return state_error; *buffer = buf; return state_command; } int via_verify_command_stream(const uint32_t * buf, unsigned int size, drm_device_t *dev, int agp) { drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private; drm_via_state_t *hc_state = &dev_priv->hc_state; drm_via_state_t saved_state = *hc_state; uint32_t cmd; const uint32_t *buf_end = buf + ( size >> 2 ); verifier_state_t state = state_command; hc_state->dev = dev; hc_state->unfinished = no_sequence; hc_state->map_cache = NULL; hc_state->agp = agp; hc_state->buf_start = buf; while (buf < buf_end) { switch (state) { case state_header2: state = via_check_header2( &buf, buf_end, hc_state ); break; case state_header1: state = via_check_header1( &buf, buf_end ); break; case state_vheader5: state = via_check_vheader5( &buf, buf_end ); break; case state_vheader6: state = via_check_vheader6( &buf, buf_end ); break; case state_command: if (HALCYON_HEADER2 == (cmd = *buf)) state = state_header2; else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1) state = state_header1; else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5) state = state_vheader5; else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6) state = state_vheader6; else { DRM_ERROR("Invalid / Unimplemented DMA HEADER command. 0x%x\n", cmd); state = state_error; } break; case state_error: default: *hc_state = saved_state; return DRM_ERR(EINVAL); } } if (state == state_error) { *hc_state = saved_state; return DRM_ERR(EINVAL); } return 0; } static void setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size) { int i; for(i=0; i<256; ++i) { table[i] = forbidden_command; } for(i=0; i<size; ++i) { table[init_table[i].code] = init_table[i].hz; } } void via_init_command_verifier( void ) { setup_hazard_table(init_table1, table1, sizeof(init_table1) / sizeof(hz_init_t)); setup_hazard_table(init_table2, table2, sizeof(init_table2) / sizeof(hz_init_t)); setup_hazard_table(init_table3, table3, sizeof(init_table3) / sizeof(hz_init_t)); }