drivers/char/drm/via_verifier.c

   1 /*
   2  * Copyright 2004 The Unichrome Project. All Rights Reserved.
   3  * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
   4  *
   5  * Permission is hereby granted, free of charge, to any person obtaining a
   6  * copy of this software and associated documentation files (the "Software"),
   7  * to deal in the Software without restriction, including without limitation
   8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
   9  * and/or sell copies of the Software, and to permit persons to whom the
  10  * Software is furnished to do so, subject to the following conditions:
  11  *
  12  * The above copyright notice and this permission notice (including the
  13  * next paragraph) shall be included in all copies or substantial portions
  14  * of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
  20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  22  * DEALINGS IN THE SOFTWARE.
  23  *
  24  * Author: Thomas Hellstrom 2004, 2005.
  25  * This code was written using docs obtained under NDA from VIA Inc.
  26  *
  27  * Don't run this code directly on an AGP buffer. Due to cache problems it will
  28  * be very slow.
  29  */
  30
  31 #include "via_3d_reg.h"
  32 #include "drmP.h"
  33 #include "drm.h"
  34 #include "via_drm.h"
  35 #include "via_verifier.h"
  36 #include "via_drv.h"
  37
  38 typedef enum {
  39         state_command,
  40         state_header2,
  41         state_header1,
  42         state_vheader5,
  43         state_vheader6,
  44         state_error
  45 } verifier_state_t;
  46
  47 typedef enum {
  48         no_check = 0,
  49         check_for_header2,
  50         check_for_header1,
  51         check_for_header2_err,
  52         check_for_header1_err,
  53         check_for_fire,
  54         check_z_buffer_addr0,
  55         check_z_buffer_addr1,
  56         check_z_buffer_addr_mode,
  57         check_destination_addr0,
  58         check_destination_addr1,
  59         check_destination_addr_mode,
  60         check_for_dummy,
  61         check_for_dd,
  62         check_texture_addr0,
  63         check_texture_addr1,
  64         check_texture_addr2,
  65         check_texture_addr3,
  66         check_texture_addr4,
  67         check_texture_addr5,
  68         check_texture_addr6,
  69         check_texture_addr7,
  70         check_texture_addr8,
  71         check_texture_addr_mode,
  72         check_for_vertex_count,
  73         check_number_texunits,
  74         forbidden_command
  75 } hazard_t;
  76
  77 /*
  78  * Associates each hazard above with a possible multi-command
  79  * sequence. For example an address that is split over multiple
  80  * commands and that needs to be checked at the first command
  81  * that does not include any part of the address.
  82  */
  83
  84 static drm_via_sequence_t seqs[] = {
  85         no_sequence,
  86         no_sequence,
  87         no_sequence,
  88         no_sequence,
  89         no_sequence,
  90         no_sequence,
  91         z_address,
  92         z_address,
  93         z_address,
  94         dest_address,
  95         dest_address,
  96         dest_address,
  97         no_sequence,
  98         no_sequence,
  99         tex_address,
 100         tex_address,
 101         tex_address,
 102         tex_address,
 103         tex_address,
 104         tex_address,
 105         tex_address,
 106         tex_address,
 107         tex_address,
 108         tex_address,
 109         no_sequence
 110 };
 111
 112 typedef struct {
 113         unsigned int code;
 114         hazard_t hz;
 115 } hz_init_t;
 116
 117 static hz_init_t init_table1[] = {
 118         {0xf2, check_for_header2_err},
 119         {0xf0, check_for_header1_err},
 120         {0xee, check_for_fire},
 121         {0xcc, check_for_dummy},
 122         {0xdd, check_for_dd},
 123         {0x00, no_check},
 124         {0x10, check_z_buffer_addr0},
 125         {0x11, check_z_buffer_addr1},
 126         {0x12, check_z_buffer_addr_mode},
 127         {0x13, no_check},
 128         {0x14, no_check},
 129         {0x15, no_check},
 130         {0x23, no_check},
 131         {0x24, no_check},
 132         {0x33, no_check},
 133         {0x34, no_check},
 134         {0x35, no_check},
 135         {0x36, no_check},
 136         {0x37, no_check},
 137         {0x38, no_check},
 138         {0x39, no_check},
 139         {0x3A, no_check},
 140         {0x3B, no_check},
 141         {0x3C, no_check},
 142         {0x3D, no_check},
 143         {0x3E, no_check},
 144         {0x40, check_destination_addr0},
 145         {0x41, check_destination_addr1},
 146         {0x42, check_destination_addr_mode},
 147         {0x43, no_check},
 148         {0x44, no_check},
 149         {0x50, no_check},
 150         {0x51, no_check},
 151         {0x52, no_check},
 152         {0x53, no_check},
 153         {0x54, no_check},
 154         {0x55, no_check},
 155         {0x56, no_check},
 156         {0x57, no_check},
 157         {0x58, no_check},
 158         {0x70, no_check},
 159         {0x71, no_check},
 160         {0x78, no_check},
 161         {0x79, no_check},
 162         {0x7A, no_check},
 163         {0x7B, no_check},
 164         {0x7C, no_check},
 165         {0x7D, check_for_vertex_count}
 166 };
 167
 168 static hz_init_t init_table2[] = {
 169         {0xf2, check_for_header2_err},
 170         {0xf0, check_for_header1_err},
 171         {0xee, check_for_fire},
 172         {0xcc, check_for_dummy},
 173         {0x00, check_texture_addr0},
 174         {0x01, check_texture_addr0},
 175         {0x02, check_texture_addr0},
 176         {0x03, check_texture_addr0},
 177         {0x04, check_texture_addr0},
 178         {0x05, check_texture_addr0},
 179         {0x06, check_texture_addr0},
 180         {0x07, check_texture_addr0},
 181         {0x08, check_texture_addr0},
 182         {0x09, check_texture_addr0},
 183         {0x20, check_texture_addr1},
 184         {0x21, check_texture_addr1},
 185         {0x22, check_texture_addr1},
 186         {0x23, check_texture_addr4},
 187         {0x2B, check_texture_addr3},
 188         {0x2C, check_texture_addr3},
 189         {0x2D, check_texture_addr3},
 190         {0x2E, check_texture_addr3},
 191         {0x2F, check_texture_addr3},
 192         {0x30, check_texture_addr3},
 193         {0x31, check_texture_addr3},
 194         {0x32, check_texture_addr3},
 195         {0x33, check_texture_addr3},
 196         {0x34, check_texture_addr3},
 197         {0x4B, check_texture_addr5},
 198         {0x4C, check_texture_addr6},
 199         {0x51, check_texture_addr7},
 200         {0x52, check_texture_addr8},
 201         {0x77, check_texture_addr2},
 202         {0x78, no_check},
 203         {0x79, no_check},
 204         {0x7A, no_check},
 205         {0x7B, check_texture_addr_mode},
 206         {0x7C, no_check},
 207         {0x7D, no_check},
 208         {0x7E, no_check},
 209         {0x7F, no_check},
 210         {0x80, no_check},
 211         {0x81, no_check},
 212         {0x82, no_check},
 213         {0x83, no_check},
 214         {0x85, no_check},
 215         {0x86, no_check},
 216         {0x87, no_check},
 217         {0x88, no_check},
 218         {0x89, no_check},
 219         {0x8A, no_check},
 220         {0x90, no_check},
 221         {0x91, no_check},
 222         {0x92, no_check},
 223         {0x93, no_check}
 224 };
 225
 226 static hz_init_t init_table3[] = {
 227         {0xf2, check_for_header2_err},
 228         {0xf0, check_for_header1_err},
 229         {0xcc, check_for_dummy},
 230         {0x00, check_number_texunits}
 231 };
 232
 233 static hazard_t table1[256];
 234 static hazard_t table2[256];
 235 static hazard_t table3[256];
 236
 237 static __inline__ int
 238 eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
 239 {
 240         if ((buf_end - *buf) >= num_words) {
 241                 *buf += num_words;
 242                 return 0;
 243         }
 244         DRM_ERROR("Illegal termination of DMA command buffer\n");
 245         return 1;
 246 }
 247
 248 /*
 249  * Partially stolen from drm_memory.h
 250  */
 251
 252 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
 253                                                     unsigned long offset,
 254                                                     unsigned long size,
 255                                                     drm_device_t * dev)
 256 {
 257         struct list_head *list;
 258         drm_map_list_t *r_list;
 259         drm_local_map_t *map = seq->map_cache;
 260
 261         if (map && map->offset <= offset
 262             && (offset + size) <= (map->offset + map->size)) {
 263                 return map;
 264         }
 265
 266         list_for_each(list, &dev->maplist->head) {
 267                 r_list = (drm_map_list_t *) list;
 268                 map = r_list->map;
 269                 if (!map)
 270                         continue;
 271                 if (map->offset <= offset
 272                     && (offset + size) <= (map->offset + map->size)
 273                     && !(map->flags & _DRM_RESTRICTED)
 274                     && (map->type == _DRM_AGP)) {
 275                         seq->map_cache = map;
 276                         return map;
 277                 }
 278         }
 279         return NULL;
 280 }
 281
 282 /*
 283  * Require that all AGP texture levels reside in the same AGP map which should
 284  * be mappable by the client. This is not a big restriction.
 285  * FIXME: To actually enforce this security policy strictly, drm_rmmap
 286  * would have to wait for dma quiescent before removing an AGP map.
 287  * The via_drm_lookup_agp_map call in reality seems to take
 288  * very little CPU time.
 289  */
 290
 291 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
 292 {
 293         switch (cur_seq->unfinished) {
 294         case z_address:
 295                 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
 296                 break;
 297         case dest_address:
 298                 DRM_DEBUG("Destination start address is 0x%x\n",
 299                           cur_seq->d_addr);
 300                 break;
 301         case tex_address:
 302                 if (cur_seq->agp_texture) {
 303                         unsigned start =
 304                             cur_seq->tex_level_lo[cur_seq->texture];
 305                         unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
 306                         unsigned long lo = ~0, hi = 0, tmp;
 307                         uint32_t *addr, *pitch, *height, tex;
 308                         unsigned i;
 309
 310                         if (end > 9)
 311                                 end = 9;
 312                         if (start > 9)
 313                                 start = 9;
 314
 315                         addr =
 316                             &(cur_seq->t_addr[tex = cur_seq->texture][start]);
 317                         pitch = &(cur_seq->pitch[tex][start]);
 318                         height = &(cur_seq->height[tex][start]);
 319
 320                         for (i = start; i <= end; ++i) {
 321                                 tmp = *addr++;
 322                                 if (tmp < lo)
 323                                         lo = tmp;
 324                                 tmp += (*height++ << *pitch++);
 325                                 if (tmp > hi)
 326                                         hi = tmp;
 327                         }
 328
 329                         if (!via_drm_lookup_agp_map
 330                             (cur_seq, lo, hi - lo, cur_seq->dev)) {
 331                                 DRM_ERROR
 332                                     ("AGP texture is not in allowed map\n");
 333                                 return 2;
 334                         }
 335                 }
 336                 break;
 337         default:
 338                 break;
 339         }
 340         cur_seq->unfinished = no_sequence;
 341         return 0;
 342 }
 343
 344 static __inline__ int
 345 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
 346 {
 347         register uint32_t tmp, *tmp_addr;
 348
 349         if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
 350                 int ret;
 351                 if ((ret = finish_current_sequence(cur_seq)))
 352                         return ret;
 353         }
 354
 355         switch (hz) {
 356         case check_for_header2:
 357                 if (cmd == HALCYON_HEADER2)
 358                         return 1;
 359                 return 0;
 360         case check_for_header1:
 361                 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
 362                         return 1;
 363                 return 0;
 364         case check_for_header2_err:
 365                 if (cmd == HALCYON_HEADER2)
 366                         return 1;
 367                 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
 368                 break;
 369         case check_for_header1_err:
 370                 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
 371                         return 1;
 372                 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
 373                 break;
 374         case check_for_fire:
 375                 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
 376                         return 1;
 377                 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
 378                 break;
 379         case check_for_dummy:
 380                 if (HC_DUMMY == cmd)
 381                         return 0;
 382                 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
 383                 break;
 384         case check_for_dd:
 385                 if (0xdddddddd == cmd)
 386                         return 0;
 387                 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
 388                 break;
 389         case check_z_buffer_addr0:
 390                 cur_seq->unfinished = z_address;
 391                 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
 392                     (cmd & 0x00FFFFFF);
 393                 return 0;
 394         case check_z_buffer_addr1:
 395                 cur_seq->unfinished = z_address;
 396                 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
 397                     ((cmd & 0xFF) << 24);
 398                 return 0;
 399         case check_z_buffer_addr_mode:
 400                 cur_seq->unfinished = z_address;
 401                 if ((cmd & 0x0000C000) == 0)
 402                         return 0;
 403                 DRM_ERROR("Attempt to place Z buffer in system memory\n");
 404                 return 2;
 405         case check_destination_addr0:
 406                 cur_seq->unfinished = dest_address;
 407                 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
 408                     (cmd & 0x00FFFFFF);
 409                 return 0;
 410         case check_destination_addr1:
 411                 cur_seq->unfinished = dest_address;
 412                 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
 413                     ((cmd & 0xFF) << 24);
 414                 return 0;
 415         case check_destination_addr_mode:
 416                 cur_seq->unfinished = dest_address;
 417                 if ((cmd & 0x0000C000) == 0)
 418                         return 0;
 419                 DRM_ERROR
 420                     ("Attempt to place 3D drawing buffer in system memory\n");
 421                 return 2;
 422         case check_texture_addr0:
 423                 cur_seq->unfinished = tex_address;
 424                 tmp = (cmd >> 24);
 425                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
 426                 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
 427                 return 0;
 428         case check_texture_addr1:
 429                 cur_seq->unfinished = tex_address;
 430                 tmp = ((cmd >> 24) - 0x20);
 431                 tmp += tmp << 1;
 432                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
 433                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
 434                 tmp_addr++;
 435                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
 436                 tmp_addr++;
 437                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
 438                 return 0;
 439         case check_texture_addr2:
 440                 cur_seq->unfinished = tex_address;
 441                 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
 442                 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
 443                 return 0;
 444         case check_texture_addr3:
 445                 cur_seq->unfinished = tex_address;
 446                 tmp = ((cmd >> 24) - 0x2B);
 447                 cur_seq->pitch[cur_seq->texture][tmp] =
 448                     (cmd & 0x00F00000) >> 20;
 449                 if (!tmp && (cmd & 0x000FFFFF)) {
 450                         DRM_ERROR
 451                             ("Unimplemented texture level 0 pitch mode.\n");
 452                         return 2;
 453                 }
 454                 return 0;
 455         case check_texture_addr4:
 456                 cur_seq->unfinished = tex_address;
 457                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
 458                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
 459                 return 0;
 460         case check_texture_addr5:
 461         case check_texture_addr6:
 462                 cur_seq->unfinished = tex_address;
 463                 /*
 464                  * Texture width. We don't care since we have the pitch.
 465                  */
 466                 return 0;
 467         case check_texture_addr7:
 468                 cur_seq->unfinished = tex_address;
 469                 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
 470                 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
 471                 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
 472                 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
 473                 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
 474                 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
 475                 tmp_addr[0] = 1 << (cmd & 0x0000000F);
 476                 return 0;
 477         case check_texture_addr8:
 478                 cur_seq->unfinished = tex_address;
 479                 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
 480                 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
 481                 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
 482                 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
 483                 tmp_addr[6] = 1 << (cmd & 0x0000000F);
 484                 return 0;
 485         case check_texture_addr_mode:
 486                 cur_seq->unfinished = tex_address;
 487                 if (2 == (tmp = cmd & 0x00000003)) {
 488                         DRM_ERROR
 489                             ("Attempt to fetch texture from system memory.\n");
 490                         return 2;
 491                 }
 492                 cur_seq->agp_texture = (tmp == 3);
 493                 cur_seq->tex_palette_size[cur_seq->texture] =
 494                     (cmd >> 16) & 0x000000007;
 495                 return 0;
 496         case check_for_vertex_count:
 497                 cur_seq->vertex_count = cmd & 0x0000FFFF;
 498                 return 0;
 499         case check_number_texunits:
 500                 cur_seq->multitex = (cmd >> 3) & 1;
 501                 return 0;
 502         default:
 503                 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
 504                 return 2;
 505         }
 506         return 2;
 507 }
 508
 509 static __inline__ int
 510 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
 511                     drm_via_state_t * cur_seq)
 512 {
 513         drm_via_private_t *dev_priv =
 514             (drm_via_private_t *) cur_seq->dev->dev_private;
 515         uint32_t a_fire, bcmd, dw_count;
 516         int ret = 0;
 517         int have_fire;
 518         const uint32_t *buf = *buffer;
 519
 520         while (buf < buf_end) {
 521                 have_fire = 0;
 522                 if ((buf_end - buf) < 2) {
 523                         DRM_ERROR
 524                             ("Unexpected termination of primitive list.\n");
 525                         ret = 1;
 526                         break;
 527                 }
 528                 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
 529                         break;
 530                 bcmd = *buf++;
 531                 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
 532                         DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
 533                                   *buf);
 534                         ret = 1;
 535                         break;
 536                 }
 537                 a_fire =
 538                     *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
 539                     HC_HE3Fire_MASK;
 540
 541                 /*
 542                  * How many dwords per vertex ?
 543                  */
 544
 545                 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
 546                         DRM_ERROR("Illegal B command vertex data for AGP.\n");
 547                         ret = 1;
 548                         break;
 549                 }
 550
 551                 dw_count = 0;
 552                 if (bcmd & (1 << 7))
 553                         dw_count += (cur_seq->multitex) ? 2 : 1;
 554                 if (bcmd & (1 << 8))
 555                         dw_count += (cur_seq->multitex) ? 2 : 1;
 556                 if (bcmd & (1 << 9))
 557                         dw_count++;
 558                 if (bcmd & (1 << 10))
 559                         dw_count++;
 560                 if (bcmd & (1 << 11))
 561                         dw_count++;
 562                 if (bcmd & (1 << 12))
 563                         dw_count++;
 564                 if (bcmd & (1 << 13))
 565                         dw_count++;
 566                 if (bcmd & (1 << 14))
 567                         dw_count++;
 568
 569                 while (buf < buf_end) {
 570                         if (*buf == a_fire) {
 571                                 if (dev_priv->num_fire_offsets >=
 572                                     VIA_FIRE_BUF_SIZE) {
 573                                         DRM_ERROR("Fire offset buffer full.\n");
 574                                         ret = 1;
 575                                         break;
 576                                 }
 577                                 dev_priv->fire_offsets[dev_priv->
 578                                                        num_fire_offsets++] =
 579                                     buf;
 580                                 have_fire = 1;
 581                                 buf++;
 582                                 if (buf < buf_end && *buf == a_fire)
 583                                         buf++;
 584                                 break;
 585                         }
 586                         if ((*buf == HALCYON_HEADER2) ||
 587                             ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
 588                                 DRM_ERROR("Missing Vertex Fire command, "
 589                                           "Stray Vertex Fire command  or verifier "
 590                                           "lost sync.\n");
 591                                 ret = 1;
 592                                 break;
 593                         }
 594                         if ((ret = eat_words(&buf, buf_end, dw_count)))
 595                                 break;
 596                 }
 597                 if (buf >= buf_end && !have_fire) {
 598                         DRM_ERROR("Missing Vertex Fire command or verifier "
 599                                   "lost sync.\n");
 600                         ret = 1;
 601                         break;
 602                 }
 603                 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
 604                         DRM_ERROR("AGP Primitive list end misaligned.\n");
 605                         ret = 1;
 606                         break;
 607                 }
 608         }
 609         *buffer = buf;
 610         return ret;
 611 }
 612
 613 static __inline__ verifier_state_t
 614 via_check_header2(uint32_t const **buffer, const uint32_t * buf_end,
 615                   drm_via_state_t * hc_state)
 616 {
 617         uint32_t cmd;
 618         int hz_mode;
 619         hazard_t hz;
 620         const uint32_t *buf = *buffer;
 621         const hazard_t *hz_table;
 622
 623         if ((buf_end - buf) < 2) {
 624                 DRM_ERROR
 625                     ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
 626                 return state_error;
 627         }
 628         buf++;
 629         cmd = (*buf++ & 0xFFFF0000) >> 16;
 630
 631         switch (cmd) {
 632         case HC_ParaType_CmdVdata:
 633                 if (via_check_prim_list(&buf, buf_end, hc_state))
 634                         return state_error;
 635                 *buffer = buf;
 636                 return state_command;
 637         case HC_ParaType_NotTex:
 638                 hz_table = table1;
 639                 break;
 640         case HC_ParaType_Tex:
 641                 hc_state->texture = 0;
 642                 hz_table = table2;
 643                 break;
 644         case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
 645                 hc_state->texture = 1;
 646                 hz_table = table2;
 647                 break;
 648         case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
 649                 hz_table = table3;
 650                 break;
 651         case HC_ParaType_Auto:
 652                 if (eat_words(&buf, buf_end, 2))
 653                         return state_error;
 654                 *buffer = buf;
 655                 return state_command;
 656         case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
 657                 if (eat_words(&buf, buf_end, 32))
 658                         return state_error;
 659                 *buffer = buf;
 660                 return state_command;
 661         case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
 662         case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
 663                 DRM_ERROR("Texture palettes are rejected because of "
 664                           "lack of info how to determine their size.\n");
 665                 return state_error;
 666         case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
 667                 DRM_ERROR("Fog factor palettes are rejected because of "
 668                           "lack of info how to determine their size.\n");
 669                 return state_error;
 670         default:
 671
 672                 /*
 673                  * There are some unimplemented HC_ParaTypes here, that
 674                  * need to be implemented if the Mesa driver is extended.
 675                  */
 676
 677                 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
 678                           "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
 679                           cmd, *(buf - 2));
 680                 *buffer = buf;
 681                 return state_error;
 682         }
 683
 684         while (buf < buf_end) {
 685                 cmd = *buf++;
 686                 if ((hz = hz_table[cmd >> 24])) {
 687                         if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
 688                                 if (hz_mode == 1) {
 689                                         buf--;
 690                                         break;
 691                                 }
 692                                 return state_error;
 693                         }
 694                 } else if (hc_state->unfinished &&
 695                            finish_current_sequence(hc_state)) {
 696                         return state_error;
 697                 }
 698         }
 699         if (hc_state->unfinished && finish_current_sequence(hc_state)) {
 700                 return state_error;
 701         }
 702         *buffer = buf;
 703         return state_command;
 704 }
 705
 706 static __inline__ verifier_state_t
 707 via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer,
 708                   const uint32_t * buf_end, int *fire_count)
 709 {
 710         uint32_t cmd;
 711         const uint32_t *buf = *buffer;
 712         const uint32_t *next_fire;
 713         int burst = 0;
 714
 715         next_fire = dev_priv->fire_offsets[*fire_count];
 716         buf++;
 717         cmd = (*buf & 0xFFFF0000) >> 16;
 718         VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
 719         switch (cmd) {
 720         case HC_ParaType_CmdVdata:
 721                 while ((buf < buf_end) &&
 722                        (*fire_count < dev_priv->num_fire_offsets) &&
 723                        (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
 724                         while (buf <= next_fire) {
 725                                 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
 726                                           (burst & 63), *buf++);
 727                                 burst += 4;
 728                         }
 729                         if ((buf < buf_end)
 730                             && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
 731                                 buf++;
 732
 733                         if (++(*fire_count) < dev_priv->num_fire_offsets)
 734                                 next_fire = dev_priv->fire_offsets[*fire_count];
 735                 }
 736                 break;
 737         default:
 738                 while (buf < buf_end) {
 739
 740                         if (*buf == HC_HEADER2 ||
 741                             (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
 742                             (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
 743                             (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
 744                                 break;
 745
 746                         VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
 747                                   (burst & 63), *buf++);
 748                         burst += 4;
 749                 }
 750         }
 751         *buffer = buf;
 752         return state_command;
 753 }
 754
 755 static __inline__ int verify_mmio_address(uint32_t address)
 756 {
 757         if ((address > 0x3FF) && (address < 0xC00)) {
 758                 DRM_ERROR("Invalid VIDEO DMA command. "
 759                           "Attempt to access 3D- or command burst area.\n");
 760                 return 1;
 761         } else if ((address > 0xCFF) && (address < 0x1300)) {
 762                 DRM_ERROR("Invalid VIDEO DMA command. "
 763                           "Attempt to access PCI DMA area.\n");
 764                 return 1;
 765         } else if (address > 0x13FF) {
 766                 DRM_ERROR("Invalid VIDEO DMA command. "
 767                           "Attempt to access VGA registers.\n");
 768                 return 1;
 769         }
 770         return 0;
 771 }
 772
 773 static __inline__ int
 774 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
 775                   uint32_t dwords)
 776 {
 777         const uint32_t *buf = *buffer;
 778
 779         if (buf_end - buf < dwords) {
 780                 DRM_ERROR("Illegal termination of video command.\n");
 781                 return 1;
 782         }
 783         while (dwords--) {
 784                 if (*buf++) {
 785                         DRM_ERROR("Illegal video command tail.\n");
 786                         return 1;
 787                 }
 788         }
 789         *buffer = buf;
 790         return 0;
 791 }
 792
 793 static __inline__ verifier_state_t
 794 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
 795 {
 796         uint32_t cmd;
 797         const uint32_t *buf = *buffer;
 798         verifier_state_t ret = state_command;
 799
 800         while (buf < buf_end) {
 801                 cmd = *buf;
 802                 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
 803                     (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
 804                         if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
 805                                 break;
 806                         DRM_ERROR("Invalid HALCYON_HEADER1 command. "
 807                                   "Attempt to access 3D- or command burst area.\n");
 808                         ret = state_error;
 809                         break;
 810                 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
 811                         if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
 812                                 break;
 813                         DRM_ERROR("Invalid HALCYON_HEADER1 command. "
 814                                   "Attempt to access VGA registers.\n");
 815                         ret = state_error;
 816                         break;
 817                 } else {
 818                         buf += 2;
 819                 }
 820         }
 821         *buffer = buf;
 822         return ret;
 823 }
 824
 825 static __inline__ verifier_state_t
 826 via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer,
 827                   const uint32_t * buf_end)
 828 {
 829         register uint32_t cmd;
 830         const uint32_t *buf = *buffer;
 831
 832         while (buf < buf_end) {
 833                 cmd = *buf;
 834                 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
 835                         break;
 836                 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
 837                 buf++;
 838         }
 839         *buffer = buf;
 840         return state_command;
 841 }
 842
 843 static __inline__ verifier_state_t
 844 via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end)
 845 {
 846         uint32_t data;
 847         const uint32_t *buf = *buffer;
 848
 849         if (buf_end - buf < 4) {
 850                 DRM_ERROR("Illegal termination of video header5 command\n");
 851                 return state_error;
 852         }
 853
 854         data = *buf++ & ~VIA_VIDEOMASK;
 855         if (verify_mmio_address(data))
 856                 return state_error;
 857
 858         data = *buf++;
 859         if (*buf++ != 0x00F50000) {
 860                 DRM_ERROR("Illegal header5 header data\n");
 861                 return state_error;
 862         }
 863         if (*buf++ != 0x00000000) {
 864                 DRM_ERROR("Illegal header5 header data\n");
 865                 return state_error;
 866         }
 867         if (eat_words(&buf, buf_end, data))
 868                 return state_error;
 869         if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
 870                 return state_error;
 871         *buffer = buf;
 872         return state_command;
 873
 874 }
 875
 876 static __inline__ verifier_state_t
 877 via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer,
 878                    const uint32_t * buf_end)
 879 {
 880         uint32_t addr, count, i;
 881         const uint32_t *buf = *buffer;
 882
 883         addr = *buf++ & ~VIA_VIDEOMASK;
 884         i = count = *buf;
 885         buf += 3;
 886         while (i--) {
 887                 VIA_WRITE(addr, *buf++);
 888         }
 889         if (count & 3)
 890                 buf += 4 - (count & 3);
 891         *buffer = buf;
 892         return state_command;
 893 }
 894
 895 static __inline__ verifier_state_t
 896 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
 897 {
 898         uint32_t data;
 899         const uint32_t *buf = *buffer;
 900         uint32_t i;
 901
 902         if (buf_end - buf < 4) {
 903                 DRM_ERROR("Illegal termination of video header6 command\n");
 904                 return state_error;
 905         }
 906         buf++;
 907         data = *buf++;
 908         if (*buf++ != 0x00F60000) {
 909                 DRM_ERROR("Illegal header6 header data\n");
 910                 return state_error;
 911         }
 912         if (*buf++ != 0x00000000) {
 913                 DRM_ERROR("Illegal header6 header data\n");
 914                 return state_error;
 915         }
 916         if ((buf_end - buf) < (data << 1)) {
 917                 DRM_ERROR("Illegal termination of video header6 command\n");
 918                 return state_error;
 919         }
 920         for (i = 0; i < data; ++i) {
 921                 if (verify_mmio_address(*buf++))
 922                         return state_error;
 923                 buf++;
 924         }
 925         data <<= 1;
 926         if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
 927                 return state_error;
 928         *buffer = buf;
 929         return state_command;
 930 }
 931
 932 static __inline__ verifier_state_t
 933 via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer,
 934                    const uint32_t * buf_end)
 935 {
 936
 937         uint32_t addr, count, i;
 938         const uint32_t *buf = *buffer;
 939
 940         i = count = *++buf;
 941         buf += 3;
 942         while (i--) {
 943                 addr = *buf++;
 944                 VIA_WRITE(addr, *buf++);
 945         }
 946         count <<= 1;
 947         if (count & 3)
 948                 buf += 4 - (count & 3);
 949         *buffer = buf;
 950         return state_command;
 951 }
 952
 953 int
 954 via_verify_command_stream(const uint32_t * buf, unsigned int size,
 955                           drm_device_t * dev, int agp)
 956 {
 957
 958         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
 959         drm_via_state_t *hc_state = &dev_priv->hc_state;
 960         drm_via_state_t saved_state = *hc_state;
 961         uint32_t cmd;
 962         const uint32_t *buf_end = buf + (size >> 2);
 963         verifier_state_t state = state_command;
 964         int pro_group_a = dev_priv->pro_group_a;
 965
 966         hc_state->dev = dev;
 967         hc_state->unfinished = no_sequence;
 968         hc_state->map_cache = NULL;
 969         hc_state->agp = agp;
 970         hc_state->buf_start = buf;
 971         dev_priv->num_fire_offsets = 0;
 972
 973         while (buf < buf_end) {
 974
 975                 switch (state) {
 976                 case state_header2:
 977                         state = via_check_header2(&buf, buf_end, hc_state);
 978                         break;
 979                 case state_header1:
 980                         state = via_check_header1(&buf, buf_end);
 981                         break;
 982                 case state_vheader5:
 983                         state = via_check_vheader5(&buf, buf_end);
 984                         break;
 985                 case state_vheader6:
 986                         state = via_check_vheader6(&buf, buf_end);
 987                         break;
 988                 case state_command:
 989                         if (HALCYON_HEADER2 == (cmd = *buf))
 990                                 state = state_header2;
 991                         else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
 992                                 state = state_header1;
 993                         else if (pro_group_a
 994                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
 995                                 state = state_vheader5;
 996                         else if (pro_group_a
 997                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
 998                                 state = state_vheader6;
 999                         else {
1000                                 DRM_ERROR
1001                                     ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1002                                      cmd);
1003                                 state = state_error;
1004                         }
1005                         break;
1006                 case state_error:
1007                 default:
1008                         *hc_state = saved_state;
1009                         return DRM_ERR(EINVAL);
1010                 }
1011         }
1012         if (state == state_error) {
1013                 *hc_state = saved_state;
1014                 return DRM_ERR(EINVAL);
1015         }
1016         return 0;
1017 }
1018
1019 int
1020 via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
1021                          unsigned int size)
1022 {
1023
1024         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1025         uint32_t cmd;
1026         const uint32_t *buf_end = buf + (size >> 2);
1027         verifier_state_t state = state_command;
1028         int fire_count = 0;
1029
1030         while (buf < buf_end) {
1031
1032                 switch (state) {
1033                 case state_header2:
1034                         state =
1035                             via_parse_header2(dev_priv, &buf, buf_end,
1036                                               &fire_count);
1037                         break;
1038                 case state_header1:
1039                         state = via_parse_header1(dev_priv, &buf, buf_end);
1040                         break;
1041                 case state_vheader5:
1042                         state = via_parse_vheader5(dev_priv, &buf, buf_end);
1043                         break;
1044                 case state_vheader6:
1045                         state = via_parse_vheader6(dev_priv, &buf, buf_end);
1046                         break;
1047                 case state_command:
1048                         if (HALCYON_HEADER2 == (cmd = *buf))
1049                                 state = state_header2;
1050                         else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1051                                 state = state_header1;
1052                         else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1053                                 state = state_vheader5;
1054                         else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1055                                 state = state_vheader6;
1056                         else {
1057                                 DRM_ERROR
1058                                     ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1059                                      cmd);
1060                                 state = state_error;
1061                         }
1062                         break;
1063                 case state_error:
1064                 default:
1065                         return DRM_ERR(EINVAL);
1066                 }
1067         }
1068         if (state == state_error) {
1069                 return DRM_ERR(EINVAL);
1070         }
1071         return 0;
1072 }
1073
1074 static void
1075 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1076 {
1077         int i;
1078
1079         for (i = 0; i < 256; ++i) {
1080                 table[i] = forbidden_command;
1081         }
1082
1083         for (i = 0; i < size; ++i) {
1084                 table[init_table[i].code] = init_table[i].hz;
1085         }
1086 }
1087
1088 void via_init_command_verifier(void)
1089 {
1090         setup_hazard_table(init_table1, table1,
1091                            sizeof(init_table1) / sizeof(hz_init_t));
1092         setup_hazard_table(init_table2, table2,
1093                            sizeof(init_table2) / sizeof(hz_init_t));
1094         setup_hazard_table(init_table3, table3,
1095                            sizeof(init_table3) / sizeof(hz_init_t));
1096 }