Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik...
[linux-2.6] / drivers / char / drm / via_verifier.c
1 /*
2  * Copyright 2004 The Unichrome Project. All Rights Reserved.
3  * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4  *
5  * Permission is hereby granted, free of charge, to any person obtaining a
6  * copy of this software and associated documentation files (the "Software"),
7  * to deal in the Software without restriction, including without limitation
8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
9  * and/or sell copies of the Software, and to permit persons to whom the
10  * Software is furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice (including the
13  * next paragraph) shall be included in all copies or substantial portions
14  * of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22  * DEALINGS IN THE SOFTWARE.
23  *
24  * Author: Thomas Hellstrom 2004, 2005.
25  * This code was written using docs obtained under NDA from VIA Inc.
26  *
27  * Don't run this code directly on an AGP buffer. Due to cache problems it will
28  * be very slow.
29  */
30
31 #include "via_3d_reg.h"
32 #include "drmP.h"
33 #include "drm.h"
34 #include "via_drm.h"
35 #include "via_verifier.h"
36 #include "via_drv.h"
37
38 typedef enum {
39         state_command,
40         state_header2,
41         state_header1,
42         state_vheader5,
43         state_vheader6,
44         state_error
45 } verifier_state_t;
46
47 typedef enum {
48         no_check = 0,
49         check_for_header2,
50         check_for_header1,
51         check_for_header2_err,
52         check_for_header1_err,
53         check_for_fire,
54         check_z_buffer_addr0,
55         check_z_buffer_addr1,
56         check_z_buffer_addr_mode,
57         check_destination_addr0,
58         check_destination_addr1,
59         check_destination_addr_mode,
60         check_for_dummy,
61         check_for_dd,
62         check_texture_addr0,
63         check_texture_addr1,
64         check_texture_addr2,
65         check_texture_addr3,
66         check_texture_addr4,
67         check_texture_addr5,
68         check_texture_addr6,
69         check_texture_addr7,
70         check_texture_addr8,
71         check_texture_addr_mode,
72         check_for_vertex_count,
73         check_number_texunits,
74         forbidden_command
75 } hazard_t;
76
77 /*
78  * Associates each hazard above with a possible multi-command
79  * sequence. For example an address that is split over multiple
80  * commands and that needs to be checked at the first command
81  * that does not include any part of the address.
82  */
83
84 static drm_via_sequence_t seqs[] = {
85         no_sequence,
86         no_sequence,
87         no_sequence,
88         no_sequence,
89         no_sequence,
90         no_sequence,
91         z_address,
92         z_address,
93         z_address,
94         dest_address,
95         dest_address,
96         dest_address,
97         no_sequence,
98         no_sequence,
99         tex_address,
100         tex_address,
101         tex_address,
102         tex_address,
103         tex_address,
104         tex_address,
105         tex_address,
106         tex_address,
107         tex_address,
108         tex_address,
109         no_sequence
110 };
111
112 typedef struct {
113         unsigned int code;
114         hazard_t hz;
115 } hz_init_t;
116
117 static hz_init_t init_table1[] = {
118         {0xf2, check_for_header2_err},
119         {0xf0, check_for_header1_err},
120         {0xee, check_for_fire},
121         {0xcc, check_for_dummy},
122         {0xdd, check_for_dd},
123         {0x00, no_check},
124         {0x10, check_z_buffer_addr0},
125         {0x11, check_z_buffer_addr1},
126         {0x12, check_z_buffer_addr_mode},
127         {0x13, no_check},
128         {0x14, no_check},
129         {0x15, no_check},
130         {0x23, no_check},
131         {0x24, no_check},
132         {0x33, no_check},
133         {0x34, no_check},
134         {0x35, no_check},
135         {0x36, no_check},
136         {0x37, no_check},
137         {0x38, no_check},
138         {0x39, no_check},
139         {0x3A, no_check},
140         {0x3B, no_check},
141         {0x3C, no_check},
142         {0x3D, no_check},
143         {0x3E, no_check},
144         {0x40, check_destination_addr0},
145         {0x41, check_destination_addr1},
146         {0x42, check_destination_addr_mode},
147         {0x43, no_check},
148         {0x44, no_check},
149         {0x50, no_check},
150         {0x51, no_check},
151         {0x52, no_check},
152         {0x53, no_check},
153         {0x54, no_check},
154         {0x55, no_check},
155         {0x56, no_check},
156         {0x57, no_check},
157         {0x58, no_check},
158         {0x70, no_check},
159         {0x71, no_check},
160         {0x78, no_check},
161         {0x79, no_check},
162         {0x7A, no_check},
163         {0x7B, no_check},
164         {0x7C, no_check},
165         {0x7D, check_for_vertex_count}
166 };
167
168 static hz_init_t init_table2[] = {
169         {0xf2, check_for_header2_err},
170         {0xf0, check_for_header1_err},
171         {0xee, check_for_fire},
172         {0xcc, check_for_dummy},
173         {0x00, check_texture_addr0},
174         {0x01, check_texture_addr0},
175         {0x02, check_texture_addr0},
176         {0x03, check_texture_addr0},
177         {0x04, check_texture_addr0},
178         {0x05, check_texture_addr0},
179         {0x06, check_texture_addr0},
180         {0x07, check_texture_addr0},
181         {0x08, check_texture_addr0},
182         {0x09, check_texture_addr0},
183         {0x20, check_texture_addr1},
184         {0x21, check_texture_addr1},
185         {0x22, check_texture_addr1},
186         {0x23, check_texture_addr4},
187         {0x2B, check_texture_addr3},
188         {0x2C, check_texture_addr3},
189         {0x2D, check_texture_addr3},
190         {0x2E, check_texture_addr3},
191         {0x2F, check_texture_addr3},
192         {0x30, check_texture_addr3},
193         {0x31, check_texture_addr3},
194         {0x32, check_texture_addr3},
195         {0x33, check_texture_addr3},
196         {0x34, check_texture_addr3},
197         {0x4B, check_texture_addr5},
198         {0x4C, check_texture_addr6},
199         {0x51, check_texture_addr7},
200         {0x52, check_texture_addr8},
201         {0x77, check_texture_addr2},
202         {0x78, no_check},
203         {0x79, no_check},
204         {0x7A, no_check},
205         {0x7B, check_texture_addr_mode},
206         {0x7C, no_check},
207         {0x7D, no_check},
208         {0x7E, no_check},
209         {0x7F, no_check},
210         {0x80, no_check},
211         {0x81, no_check},
212         {0x82, no_check},
213         {0x83, no_check},
214         {0x85, no_check},
215         {0x86, no_check},
216         {0x87, no_check},
217         {0x88, no_check},
218         {0x89, no_check},
219         {0x8A, no_check},
220         {0x90, no_check},
221         {0x91, no_check},
222         {0x92, no_check},
223         {0x93, no_check}
224 };
225
226 static hz_init_t init_table3[] = {
227         {0xf2, check_for_header2_err},
228         {0xf0, check_for_header1_err},
229         {0xcc, check_for_dummy},
230         {0x00, check_number_texunits}
231 };
232
233 static hazard_t table1[256];
234 static hazard_t table2[256];
235 static hazard_t table3[256];
236
237 static __inline__ int
238 eat_words(const uint32_t ** buf, const uint32_t * buf_end, unsigned num_words)
239 {
240         if ((buf_end - *buf) >= num_words) {
241                 *buf += num_words;
242                 return 0;
243         }
244         DRM_ERROR("Illegal termination of DMA command buffer\n");
245         return 1;
246 }
247
248 /*
249  * Partially stolen from drm_memory.h
250  */
251
252 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
253                                                     unsigned long offset,
254                                                     unsigned long size,
255                                                     drm_device_t * dev)
256 {
257         struct list_head *list;
258         drm_map_list_t *r_list;
259         drm_local_map_t *map = seq->map_cache;
260
261         if (map && map->offset <= offset
262             && (offset + size) <= (map->offset + map->size)) {
263                 return map;
264         }
265
266         list_for_each(list, &dev->maplist->head) {
267                 r_list = (drm_map_list_t *) list;
268                 map = r_list->map;
269                 if (!map)
270                         continue;
271                 if (map->offset <= offset
272                     && (offset + size) <= (map->offset + map->size)
273                     && !(map->flags & _DRM_RESTRICTED)
274                     && (map->type == _DRM_AGP)) {
275                         seq->map_cache = map;
276                         return map;
277                 }
278         }
279         return NULL;
280 }
281
282 /*
283  * Require that all AGP texture levels reside in the same AGP map which should
284  * be mappable by the client. This is not a big restriction.
285  * FIXME: To actually enforce this security policy strictly, drm_rmmap
286  * would have to wait for dma quiescent before removing an AGP map.
287  * The via_drm_lookup_agp_map call in reality seems to take
288  * very little CPU time.
289  */
290
291 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
292 {
293         switch (cur_seq->unfinished) {
294         case z_address:
295                 DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
296                 break;
297         case dest_address:
298                 DRM_DEBUG("Destination start address is 0x%x\n",
299                           cur_seq->d_addr);
300                 break;
301         case tex_address:
302                 if (cur_seq->agp_texture) {
303                         unsigned start =
304                             cur_seq->tex_level_lo[cur_seq->texture];
305                         unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
306                         unsigned long lo = ~0, hi = 0, tmp;
307                         uint32_t *addr, *pitch, *height, tex;
308                         unsigned i;
309                         int npot;
310
311                         if (end > 9)
312                                 end = 9;
313                         if (start > 9)
314                                 start = 9;
315
316                         addr =
317                             &(cur_seq->t_addr[tex = cur_seq->texture][start]);
318                         pitch = &(cur_seq->pitch[tex][start]);
319                         height = &(cur_seq->height[tex][start]);
320                         npot = cur_seq->tex_npot[tex];
321                         for (i = start; i <= end; ++i) {
322                                 tmp = *addr++;
323                                 if (tmp < lo)
324                                         lo = tmp;
325                                 if (i == 0 && npot)
326                                         tmp += (*height++ * *pitch++);
327                                 else
328                                         tmp += (*height++ << *pitch++);
329                                 if (tmp > hi)
330                                         hi = tmp;
331                         }
332
333                         if (!via_drm_lookup_agp_map
334                             (cur_seq, lo, hi - lo, cur_seq->dev)) {
335                                 DRM_ERROR
336                                     ("AGP texture is not in allowed map\n");
337                                 return 2;
338                         }
339                 }
340                 break;
341         default:
342                 break;
343         }
344         cur_seq->unfinished = no_sequence;
345         return 0;
346 }
347
348 static __inline__ int
349 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t * cur_seq)
350 {
351         register uint32_t tmp, *tmp_addr;
352
353         if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
354                 int ret;
355                 if ((ret = finish_current_sequence(cur_seq)))
356                         return ret;
357         }
358
359         switch (hz) {
360         case check_for_header2:
361                 if (cmd == HALCYON_HEADER2)
362                         return 1;
363                 return 0;
364         case check_for_header1:
365                 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
366                         return 1;
367                 return 0;
368         case check_for_header2_err:
369                 if (cmd == HALCYON_HEADER2)
370                         return 1;
371                 DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
372                 break;
373         case check_for_header1_err:
374                 if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
375                         return 1;
376                 DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
377                 break;
378         case check_for_fire:
379                 if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
380                         return 1;
381                 DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
382                 break;
383         case check_for_dummy:
384                 if (HC_DUMMY == cmd)
385                         return 0;
386                 DRM_ERROR("Illegal DMA HC_DUMMY command\n");
387                 break;
388         case check_for_dd:
389                 if (0xdddddddd == cmd)
390                         return 0;
391                 DRM_ERROR("Illegal DMA 0xdddddddd command\n");
392                 break;
393         case check_z_buffer_addr0:
394                 cur_seq->unfinished = z_address;
395                 cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
396                     (cmd & 0x00FFFFFF);
397                 return 0;
398         case check_z_buffer_addr1:
399                 cur_seq->unfinished = z_address;
400                 cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
401                     ((cmd & 0xFF) << 24);
402                 return 0;
403         case check_z_buffer_addr_mode:
404                 cur_seq->unfinished = z_address;
405                 if ((cmd & 0x0000C000) == 0)
406                         return 0;
407                 DRM_ERROR("Attempt to place Z buffer in system memory\n");
408                 return 2;
409         case check_destination_addr0:
410                 cur_seq->unfinished = dest_address;
411                 cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
412                     (cmd & 0x00FFFFFF);
413                 return 0;
414         case check_destination_addr1:
415                 cur_seq->unfinished = dest_address;
416                 cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
417                     ((cmd & 0xFF) << 24);
418                 return 0;
419         case check_destination_addr_mode:
420                 cur_seq->unfinished = dest_address;
421                 if ((cmd & 0x0000C000) == 0)
422                         return 0;
423                 DRM_ERROR
424                     ("Attempt to place 3D drawing buffer in system memory\n");
425                 return 2;
426         case check_texture_addr0:
427                 cur_seq->unfinished = tex_address;
428                 tmp = (cmd >> 24);
429                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
430                 *tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
431                 return 0;
432         case check_texture_addr1:
433                 cur_seq->unfinished = tex_address;
434                 tmp = ((cmd >> 24) - 0x20);
435                 tmp += tmp << 1;
436                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
437                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
438                 tmp_addr++;
439                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
440                 tmp_addr++;
441                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
442                 return 0;
443         case check_texture_addr2:
444                 cur_seq->unfinished = tex_address;
445                 cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
446                 cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
447                 return 0;
448         case check_texture_addr3:
449                 cur_seq->unfinished = tex_address;
450                 tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
451                 if (tmp == 0 &&
452                     (cmd & HC_HTXnEnPit_MASK)) {
453                         cur_seq->pitch[cur_seq->texture][tmp] =
454                                 (cmd & HC_HTXnLnPit_MASK);
455                         cur_seq->tex_npot[cur_seq->texture] = 1;
456                 } else {
457                         cur_seq->pitch[cur_seq->texture][tmp] =
458                                 (cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
459                         cur_seq->tex_npot[cur_seq->texture] = 0;
460                         if (cmd & 0x000FFFFF) {
461                                 DRM_ERROR
462                                         ("Unimplemented texture level 0 pitch mode.\n");
463                                 return 2;
464                         }
465                 }
466                 return 0;
467         case check_texture_addr4:
468                 cur_seq->unfinished = tex_address;
469                 tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
470                 *tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
471                 return 0;
472         case check_texture_addr5:
473         case check_texture_addr6:
474                 cur_seq->unfinished = tex_address;
475                 /*
476                  * Texture width. We don't care since we have the pitch.
477                  */
478                 return 0;
479         case check_texture_addr7:
480                 cur_seq->unfinished = tex_address;
481                 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
482                 tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
483                 tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
484                 tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
485                 tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
486                 tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
487                 tmp_addr[0] = 1 << (cmd & 0x0000000F);
488                 return 0;
489         case check_texture_addr8:
490                 cur_seq->unfinished = tex_address;
491                 tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
492                 tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
493                 tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
494                 tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
495                 tmp_addr[6] = 1 << (cmd & 0x0000000F);
496                 return 0;
497         case check_texture_addr_mode:
498                 cur_seq->unfinished = tex_address;
499                 if (2 == (tmp = cmd & 0x00000003)) {
500                         DRM_ERROR
501                             ("Attempt to fetch texture from system memory.\n");
502                         return 2;
503                 }
504                 cur_seq->agp_texture = (tmp == 3);
505                 cur_seq->tex_palette_size[cur_seq->texture] =
506                     (cmd >> 16) & 0x000000007;
507                 return 0;
508         case check_for_vertex_count:
509                 cur_seq->vertex_count = cmd & 0x0000FFFF;
510                 return 0;
511         case check_number_texunits:
512                 cur_seq->multitex = (cmd >> 3) & 1;
513                 return 0;
514         default:
515                 DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
516                 return 2;
517         }
518         return 2;
519 }
520
521 static __inline__ int
522 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
523                     drm_via_state_t * cur_seq)
524 {
525         drm_via_private_t *dev_priv =
526             (drm_via_private_t *) cur_seq->dev->dev_private;
527         uint32_t a_fire, bcmd, dw_count;
528         int ret = 0;
529         int have_fire;
530         const uint32_t *buf = *buffer;
531
532         while (buf < buf_end) {
533                 have_fire = 0;
534                 if ((buf_end - buf) < 2) {
535                         DRM_ERROR
536                             ("Unexpected termination of primitive list.\n");
537                         ret = 1;
538                         break;
539                 }
540                 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
541                         break;
542                 bcmd = *buf++;
543                 if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
544                         DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
545                                   *buf);
546                         ret = 1;
547                         break;
548                 }
549                 a_fire =
550                     *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
551                     HC_HE3Fire_MASK;
552
553                 /*
554                  * How many dwords per vertex ?
555                  */
556
557                 if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
558                         DRM_ERROR("Illegal B command vertex data for AGP.\n");
559                         ret = 1;
560                         break;
561                 }
562
563                 dw_count = 0;
564                 if (bcmd & (1 << 7))
565                         dw_count += (cur_seq->multitex) ? 2 : 1;
566                 if (bcmd & (1 << 8))
567                         dw_count += (cur_seq->multitex) ? 2 : 1;
568                 if (bcmd & (1 << 9))
569                         dw_count++;
570                 if (bcmd & (1 << 10))
571                         dw_count++;
572                 if (bcmd & (1 << 11))
573                         dw_count++;
574                 if (bcmd & (1 << 12))
575                         dw_count++;
576                 if (bcmd & (1 << 13))
577                         dw_count++;
578                 if (bcmd & (1 << 14))
579                         dw_count++;
580
581                 while (buf < buf_end) {
582                         if (*buf == a_fire) {
583                                 if (dev_priv->num_fire_offsets >=
584                                     VIA_FIRE_BUF_SIZE) {
585                                         DRM_ERROR("Fire offset buffer full.\n");
586                                         ret = 1;
587                                         break;
588                                 }
589                                 dev_priv->fire_offsets[dev_priv->
590                                                        num_fire_offsets++] =
591                                     buf;
592                                 have_fire = 1;
593                                 buf++;
594                                 if (buf < buf_end && *buf == a_fire)
595                                         buf++;
596                                 break;
597                         }
598                         if ((*buf == HALCYON_HEADER2) ||
599                             ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
600                                 DRM_ERROR("Missing Vertex Fire command, "
601                                           "Stray Vertex Fire command  or verifier "
602                                           "lost sync.\n");
603                                 ret = 1;
604                                 break;
605                         }
606                         if ((ret = eat_words(&buf, buf_end, dw_count)))
607                                 break;
608                 }
609                 if (buf >= buf_end && !have_fire) {
610                         DRM_ERROR("Missing Vertex Fire command or verifier "
611                                   "lost sync.\n");
612                         ret = 1;
613                         break;
614                 }
615                 if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
616                         DRM_ERROR("AGP Primitive list end misaligned.\n");
617                         ret = 1;
618                         break;
619                 }
620         }
621         *buffer = buf;
622         return ret;
623 }
624
625 static __inline__ verifier_state_t
626 via_check_header2(uint32_t const **buffer, const uint32_t * buf_end,
627                   drm_via_state_t * hc_state)
628 {
629         uint32_t cmd;
630         int hz_mode;
631         hazard_t hz;
632         const uint32_t *buf = *buffer;
633         const hazard_t *hz_table;
634
635         if ((buf_end - buf) < 2) {
636                 DRM_ERROR
637                     ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
638                 return state_error;
639         }
640         buf++;
641         cmd = (*buf++ & 0xFFFF0000) >> 16;
642
643         switch (cmd) {
644         case HC_ParaType_CmdVdata:
645                 if (via_check_prim_list(&buf, buf_end, hc_state))
646                         return state_error;
647                 *buffer = buf;
648                 return state_command;
649         case HC_ParaType_NotTex:
650                 hz_table = table1;
651                 break;
652         case HC_ParaType_Tex:
653                 hc_state->texture = 0;
654                 hz_table = table2;
655                 break;
656         case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
657                 hc_state->texture = 1;
658                 hz_table = table2;
659                 break;
660         case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
661                 hz_table = table3;
662                 break;
663         case HC_ParaType_Auto:
664                 if (eat_words(&buf, buf_end, 2))
665                         return state_error;
666                 *buffer = buf;
667                 return state_command;
668         case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
669                 if (eat_words(&buf, buf_end, 32))
670                         return state_error;
671                 *buffer = buf;
672                 return state_command;
673         case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
674         case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
675                 DRM_ERROR("Texture palettes are rejected because of "
676                           "lack of info how to determine their size.\n");
677                 return state_error;
678         case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
679                 DRM_ERROR("Fog factor palettes are rejected because of "
680                           "lack of info how to determine their size.\n");
681                 return state_error;
682         default:
683
684                 /*
685                  * There are some unimplemented HC_ParaTypes here, that
686                  * need to be implemented if the Mesa driver is extended.
687                  */
688
689                 DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
690                           "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
691                           cmd, *(buf - 2));
692                 *buffer = buf;
693                 return state_error;
694         }
695
696         while (buf < buf_end) {
697                 cmd = *buf++;
698                 if ((hz = hz_table[cmd >> 24])) {
699                         if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
700                                 if (hz_mode == 1) {
701                                         buf--;
702                                         break;
703                                 }
704                                 return state_error;
705                         }
706                 } else if (hc_state->unfinished &&
707                            finish_current_sequence(hc_state)) {
708                         return state_error;
709                 }
710         }
711         if (hc_state->unfinished && finish_current_sequence(hc_state)) {
712                 return state_error;
713         }
714         *buffer = buf;
715         return state_command;
716 }
717
718 static __inline__ verifier_state_t
719 via_parse_header2(drm_via_private_t * dev_priv, uint32_t const **buffer,
720                   const uint32_t * buf_end, int *fire_count)
721 {
722         uint32_t cmd;
723         const uint32_t *buf = *buffer;
724         const uint32_t *next_fire;
725         int burst = 0;
726
727         next_fire = dev_priv->fire_offsets[*fire_count];
728         buf++;
729         cmd = (*buf & 0xFFFF0000) >> 16;
730         VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
731         switch (cmd) {
732         case HC_ParaType_CmdVdata:
733                 while ((buf < buf_end) &&
734                        (*fire_count < dev_priv->num_fire_offsets) &&
735                        (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
736                         while (buf <= next_fire) {
737                                 VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
738                                           (burst & 63), *buf++);
739                                 burst += 4;
740                         }
741                         if ((buf < buf_end)
742                             && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
743                                 buf++;
744
745                         if (++(*fire_count) < dev_priv->num_fire_offsets)
746                                 next_fire = dev_priv->fire_offsets[*fire_count];
747                 }
748                 break;
749         default:
750                 while (buf < buf_end) {
751
752                         if (*buf == HC_HEADER2 ||
753                             (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
754                             (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
755                             (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
756                                 break;
757
758                         VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
759                                   (burst & 63), *buf++);
760                         burst += 4;
761                 }
762         }
763         *buffer = buf;
764         return state_command;
765 }
766
767 static __inline__ int verify_mmio_address(uint32_t address)
768 {
769         if ((address > 0x3FF) && (address < 0xC00)) {
770                 DRM_ERROR("Invalid VIDEO DMA command. "
771                           "Attempt to access 3D- or command burst area.\n");
772                 return 1;
773         } else if ((address > 0xCFF) && (address < 0x1300)) {
774                 DRM_ERROR("Invalid VIDEO DMA command. "
775                           "Attempt to access PCI DMA area.\n");
776                 return 1;
777         } else if (address > 0x13FF) {
778                 DRM_ERROR("Invalid VIDEO DMA command. "
779                           "Attempt to access VGA registers.\n");
780                 return 1;
781         }
782         return 0;
783 }
784
785 static __inline__ int
786 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
787                   uint32_t dwords)
788 {
789         const uint32_t *buf = *buffer;
790
791         if (buf_end - buf < dwords) {
792                 DRM_ERROR("Illegal termination of video command.\n");
793                 return 1;
794         }
795         while (dwords--) {
796                 if (*buf++) {
797                         DRM_ERROR("Illegal video command tail.\n");
798                         return 1;
799                 }
800         }
801         *buffer = buf;
802         return 0;
803 }
804
805 static __inline__ verifier_state_t
806 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
807 {
808         uint32_t cmd;
809         const uint32_t *buf = *buffer;
810         verifier_state_t ret = state_command;
811
812         while (buf < buf_end) {
813                 cmd = *buf;
814                 if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
815                     (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
816                         if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
817                                 break;
818                         DRM_ERROR("Invalid HALCYON_HEADER1 command. "
819                                   "Attempt to access 3D- or command burst area.\n");
820                         ret = state_error;
821                         break;
822                 } else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
823                         if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
824                                 break;
825                         DRM_ERROR("Invalid HALCYON_HEADER1 command. "
826                                   "Attempt to access VGA registers.\n");
827                         ret = state_error;
828                         break;
829                 } else {
830                         buf += 2;
831                 }
832         }
833         *buffer = buf;
834         return ret;
835 }
836
837 static __inline__ verifier_state_t
838 via_parse_header1(drm_via_private_t * dev_priv, uint32_t const **buffer,
839                   const uint32_t * buf_end)
840 {
841         register uint32_t cmd;
842         const uint32_t *buf = *buffer;
843
844         while (buf < buf_end) {
845                 cmd = *buf;
846                 if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
847                         break;
848                 VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
849                 buf++;
850         }
851         *buffer = buf;
852         return state_command;
853 }
854
855 static __inline__ verifier_state_t
856 via_check_vheader5(uint32_t const **buffer, const uint32_t * buf_end)
857 {
858         uint32_t data;
859         const uint32_t *buf = *buffer;
860
861         if (buf_end - buf < 4) {
862                 DRM_ERROR("Illegal termination of video header5 command\n");
863                 return state_error;
864         }
865
866         data = *buf++ & ~VIA_VIDEOMASK;
867         if (verify_mmio_address(data))
868                 return state_error;
869
870         data = *buf++;
871         if (*buf++ != 0x00F50000) {
872                 DRM_ERROR("Illegal header5 header data\n");
873                 return state_error;
874         }
875         if (*buf++ != 0x00000000) {
876                 DRM_ERROR("Illegal header5 header data\n");
877                 return state_error;
878         }
879         if (eat_words(&buf, buf_end, data))
880                 return state_error;
881         if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
882                 return state_error;
883         *buffer = buf;
884         return state_command;
885
886 }
887
888 static __inline__ verifier_state_t
889 via_parse_vheader5(drm_via_private_t * dev_priv, uint32_t const **buffer,
890                    const uint32_t * buf_end)
891 {
892         uint32_t addr, count, i;
893         const uint32_t *buf = *buffer;
894
895         addr = *buf++ & ~VIA_VIDEOMASK;
896         i = count = *buf;
897         buf += 3;
898         while (i--) {
899                 VIA_WRITE(addr, *buf++);
900         }
901         if (count & 3)
902                 buf += 4 - (count & 3);
903         *buffer = buf;
904         return state_command;
905 }
906
907 static __inline__ verifier_state_t
908 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
909 {
910         uint32_t data;
911         const uint32_t *buf = *buffer;
912         uint32_t i;
913
914         if (buf_end - buf < 4) {
915                 DRM_ERROR("Illegal termination of video header6 command\n");
916                 return state_error;
917         }
918         buf++;
919         data = *buf++;
920         if (*buf++ != 0x00F60000) {
921                 DRM_ERROR("Illegal header6 header data\n");
922                 return state_error;
923         }
924         if (*buf++ != 0x00000000) {
925                 DRM_ERROR("Illegal header6 header data\n");
926                 return state_error;
927         }
928         if ((buf_end - buf) < (data << 1)) {
929                 DRM_ERROR("Illegal termination of video header6 command\n");
930                 return state_error;
931         }
932         for (i = 0; i < data; ++i) {
933                 if (verify_mmio_address(*buf++))
934                         return state_error;
935                 buf++;
936         }
937         data <<= 1;
938         if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
939                 return state_error;
940         *buffer = buf;
941         return state_command;
942 }
943
944 static __inline__ verifier_state_t
945 via_parse_vheader6(drm_via_private_t * dev_priv, uint32_t const **buffer,
946                    const uint32_t * buf_end)
947 {
948
949         uint32_t addr, count, i;
950         const uint32_t *buf = *buffer;
951
952         i = count = *++buf;
953         buf += 3;
954         while (i--) {
955                 addr = *buf++;
956                 VIA_WRITE(addr, *buf++);
957         }
958         count <<= 1;
959         if (count & 3)
960                 buf += 4 - (count & 3);
961         *buffer = buf;
962         return state_command;
963 }
964
965 int
966 via_verify_command_stream(const uint32_t * buf, unsigned int size,
967                           drm_device_t * dev, int agp)
968 {
969
970         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
971         drm_via_state_t *hc_state = &dev_priv->hc_state;
972         drm_via_state_t saved_state = *hc_state;
973         uint32_t cmd;
974         const uint32_t *buf_end = buf + (size >> 2);
975         verifier_state_t state = state_command;
976         int cme_video;
977         int supported_3d;
978
979         cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
980                      dev_priv->chipset == VIA_DX9_0);
981
982         supported_3d = dev_priv->chipset != VIA_DX9_0;
983
984         hc_state->dev = dev;
985         hc_state->unfinished = no_sequence;
986         hc_state->map_cache = NULL;
987         hc_state->agp = agp;
988         hc_state->buf_start = buf;
989         dev_priv->num_fire_offsets = 0;
990
991         while (buf < buf_end) {
992
993                 switch (state) {
994                 case state_header2:
995                         state = via_check_header2(&buf, buf_end, hc_state);
996                         break;
997                 case state_header1:
998                         state = via_check_header1(&buf, buf_end);
999                         break;
1000                 case state_vheader5:
1001                         state = via_check_vheader5(&buf, buf_end);
1002                         break;
1003                 case state_vheader6:
1004                         state = via_check_vheader6(&buf, buf_end);
1005                         break;
1006                 case state_command:
1007                         if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1008                             supported_3d)
1009                                 state = state_header2;
1010                         else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1011                                 state = state_header1;
1012                         else if (cme_video
1013                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1014                                 state = state_vheader5;
1015                         else if (cme_video
1016                                  && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1017                                 state = state_vheader6;
1018                         else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1019                                 DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1020                                 state = state_error;
1021                         } else {
1022                                 DRM_ERROR
1023                                     ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1024                                      cmd);
1025                                 state = state_error;
1026                         }
1027                         break;
1028                 case state_error:
1029                 default:
1030                         *hc_state = saved_state;
1031                         return DRM_ERR(EINVAL);
1032                 }
1033         }
1034         if (state == state_error) {
1035                 *hc_state = saved_state;
1036                 return DRM_ERR(EINVAL);
1037         }
1038         return 0;
1039 }
1040
1041 int
1042 via_parse_command_stream(drm_device_t * dev, const uint32_t * buf,
1043                          unsigned int size)
1044 {
1045
1046         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1047         uint32_t cmd;
1048         const uint32_t *buf_end = buf + (size >> 2);
1049         verifier_state_t state = state_command;
1050         int fire_count = 0;
1051
1052         while (buf < buf_end) {
1053
1054                 switch (state) {
1055                 case state_header2:
1056                         state =
1057                             via_parse_header2(dev_priv, &buf, buf_end,
1058                                               &fire_count);
1059                         break;
1060                 case state_header1:
1061                         state = via_parse_header1(dev_priv, &buf, buf_end);
1062                         break;
1063                 case state_vheader5:
1064                         state = via_parse_vheader5(dev_priv, &buf, buf_end);
1065                         break;
1066                 case state_vheader6:
1067                         state = via_parse_vheader6(dev_priv, &buf, buf_end);
1068                         break;
1069                 case state_command:
1070                         if (HALCYON_HEADER2 == (cmd = *buf))
1071                                 state = state_header2;
1072                         else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1073                                 state = state_header1;
1074                         else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1075                                 state = state_vheader5;
1076                         else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1077                                 state = state_vheader6;
1078                         else {
1079                                 DRM_ERROR
1080                                     ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1081                                      cmd);
1082                                 state = state_error;
1083                         }
1084                         break;
1085                 case state_error:
1086                 default:
1087                         return DRM_ERR(EINVAL);
1088                 }
1089         }
1090         if (state == state_error) {
1091                 return DRM_ERR(EINVAL);
1092         }
1093         return 0;
1094 }
1095
1096 static void
1097 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1098 {
1099         int i;
1100
1101         for (i = 0; i < 256; ++i) {
1102                 table[i] = forbidden_command;
1103         }
1104
1105         for (i = 0; i < size; ++i) {
1106                 table[init_table[i].code] = init_table[i].hz;
1107         }
1108 }
1109
1110 void via_init_command_verifier(void)
1111 {
1112         setup_hazard_table(init_table1, table1,
1113                            sizeof(init_table1) / sizeof(hz_init_t));
1114         setup_hazard_table(init_table2, table2,
1115                            sizeof(init_table2) / sizeof(hz_init_t));
1116         setup_hazard_table(init_table3, table3,
1117                            sizeof(init_table3) / sizeof(hz_init_t));
1118 }