xref: /netbsd-src/sys/external/bsd/drm2/dist/drm/via/via_verifier.c (revision 6d322f2f4598f0d8a138f10ea648ec4fabe41f8b)
1 /*
2  * Copyright 2004 The Unichrome Project. All Rights Reserved.
3  * Copyright 2005 Thomas Hellstrom. All Rights Reserved.
4  *
5  * Permission is hereby granted, free of charge, to any person obtaining a
6  * copy of this software and associated documentation files (the "Software"),
7  * to deal in the Software without restriction, including without limitation
8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
9  * and/or sell copies of the Software, and to permit persons to whom the
10  * Software is furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice (including the
13  * next paragraph) shall be included in all copies or substantial portions
14  * of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHOR(S), AND/OR THE COPYRIGHT HOLDER(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
22  * DEALINGS IN THE SOFTWARE.
23  *
24  * Author: Thomas Hellstrom 2004, 2005.
25  * This code was written using docs obtained under NDA from VIA Inc.
26  *
27  * Don't run this code directly on an AGP buffer. Due to cache problems it will
28  * be very slow.
29  */
30 
31 #include "via_3d_reg.h"
32 #include <drm/drmP.h>
33 #include <drm/via_drm.h>
34 #include "via_verifier.h"
35 #include "via_drv.h"
36 
37 typedef enum {
38 	state_command,
39 	state_header2,
40 	state_header1,
41 	state_vheader5,
42 	state_vheader6,
43 	state_error
44 } verifier_state_t;
45 
46 typedef enum {
47 	no_check = 0,
48 	check_for_header2,
49 	check_for_header1,
50 	check_for_header2_err,
51 	check_for_header1_err,
52 	check_for_fire,
53 	check_z_buffer_addr0,
54 	check_z_buffer_addr1,
55 	check_z_buffer_addr_mode,
56 	check_destination_addr0,
57 	check_destination_addr1,
58 	check_destination_addr_mode,
59 	check_for_dummy,
60 	check_for_dd,
61 	check_texture_addr0,
62 	check_texture_addr1,
63 	check_texture_addr2,
64 	check_texture_addr3,
65 	check_texture_addr4,
66 	check_texture_addr5,
67 	check_texture_addr6,
68 	check_texture_addr7,
69 	check_texture_addr8,
70 	check_texture_addr_mode,
71 	check_for_vertex_count,
72 	check_number_texunits,
73 	forbidden_command
74 } hazard_t;
75 
76 /*
77  * Associates each hazard above with a possible multi-command
78  * sequence. For example an address that is split over multiple
79  * commands and that needs to be checked at the first command
80  * that does not include any part of the address.
81  */
82 
83 static drm_via_sequence_t seqs[] = {
84 	no_sequence,
85 	no_sequence,
86 	no_sequence,
87 	no_sequence,
88 	no_sequence,
89 	no_sequence,
90 	z_address,
91 	z_address,
92 	z_address,
93 	dest_address,
94 	dest_address,
95 	dest_address,
96 	no_sequence,
97 	no_sequence,
98 	tex_address,
99 	tex_address,
100 	tex_address,
101 	tex_address,
102 	tex_address,
103 	tex_address,
104 	tex_address,
105 	tex_address,
106 	tex_address,
107 	tex_address,
108 	no_sequence
109 };
110 
111 typedef struct {
112 	unsigned int code;
113 	hazard_t hz;
114 } hz_init_t;
115 
116 static hz_init_t init_table1[] = {
117 	{0xf2, check_for_header2_err},
118 	{0xf0, check_for_header1_err},
119 	{0xee, check_for_fire},
120 	{0xcc, check_for_dummy},
121 	{0xdd, check_for_dd},
122 	{0x00, no_check},
123 	{0x10, check_z_buffer_addr0},
124 	{0x11, check_z_buffer_addr1},
125 	{0x12, check_z_buffer_addr_mode},
126 	{0x13, no_check},
127 	{0x14, no_check},
128 	{0x15, no_check},
129 	{0x23, no_check},
130 	{0x24, no_check},
131 	{0x33, no_check},
132 	{0x34, no_check},
133 	{0x35, no_check},
134 	{0x36, no_check},
135 	{0x37, no_check},
136 	{0x38, no_check},
137 	{0x39, no_check},
138 	{0x3A, no_check},
139 	{0x3B, no_check},
140 	{0x3C, no_check},
141 	{0x3D, no_check},
142 	{0x3E, no_check},
143 	{0x40, check_destination_addr0},
144 	{0x41, check_destination_addr1},
145 	{0x42, check_destination_addr_mode},
146 	{0x43, no_check},
147 	{0x44, no_check},
148 	{0x50, no_check},
149 	{0x51, no_check},
150 	{0x52, no_check},
151 	{0x53, no_check},
152 	{0x54, no_check},
153 	{0x55, no_check},
154 	{0x56, no_check},
155 	{0x57, no_check},
156 	{0x58, no_check},
157 	{0x70, no_check},
158 	{0x71, no_check},
159 	{0x78, no_check},
160 	{0x79, no_check},
161 	{0x7A, no_check},
162 	{0x7B, no_check},
163 	{0x7C, no_check},
164 	{0x7D, check_for_vertex_count}
165 };
166 
167 static hz_init_t init_table2[] = {
168 	{0xf2, check_for_header2_err},
169 	{0xf0, check_for_header1_err},
170 	{0xee, check_for_fire},
171 	{0xcc, check_for_dummy},
172 	{0x00, check_texture_addr0},
173 	{0x01, check_texture_addr0},
174 	{0x02, check_texture_addr0},
175 	{0x03, check_texture_addr0},
176 	{0x04, check_texture_addr0},
177 	{0x05, check_texture_addr0},
178 	{0x06, check_texture_addr0},
179 	{0x07, check_texture_addr0},
180 	{0x08, check_texture_addr0},
181 	{0x09, check_texture_addr0},
182 	{0x20, check_texture_addr1},
183 	{0x21, check_texture_addr1},
184 	{0x22, check_texture_addr1},
185 	{0x23, check_texture_addr4},
186 	{0x2B, check_texture_addr3},
187 	{0x2C, check_texture_addr3},
188 	{0x2D, check_texture_addr3},
189 	{0x2E, check_texture_addr3},
190 	{0x2F, check_texture_addr3},
191 	{0x30, check_texture_addr3},
192 	{0x31, check_texture_addr3},
193 	{0x32, check_texture_addr3},
194 	{0x33, check_texture_addr3},
195 	{0x34, check_texture_addr3},
196 	{0x4B, check_texture_addr5},
197 	{0x4C, check_texture_addr6},
198 	{0x51, check_texture_addr7},
199 	{0x52, check_texture_addr8},
200 	{0x77, check_texture_addr2},
201 	{0x78, no_check},
202 	{0x79, no_check},
203 	{0x7A, no_check},
204 	{0x7B, check_texture_addr_mode},
205 	{0x7C, no_check},
206 	{0x7D, no_check},
207 	{0x7E, no_check},
208 	{0x7F, no_check},
209 	{0x80, no_check},
210 	{0x81, no_check},
211 	{0x82, no_check},
212 	{0x83, no_check},
213 	{0x85, no_check},
214 	{0x86, no_check},
215 	{0x87, no_check},
216 	{0x88, no_check},
217 	{0x89, no_check},
218 	{0x8A, no_check},
219 	{0x90, no_check},
220 	{0x91, no_check},
221 	{0x92, no_check},
222 	{0x93, no_check}
223 };
224 
225 static hz_init_t init_table3[] = {
226 	{0xf2, check_for_header2_err},
227 	{0xf0, check_for_header1_err},
228 	{0xcc, check_for_dummy},
229 	{0x00, check_number_texunits}
230 };
231 
232 static hazard_t table1[256];
233 static hazard_t table2[256];
234 static hazard_t table3[256];
235 
236 static __inline__ int
237 eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
238 {
239 	if ((buf_end - *buf) >= num_words) {
240 		*buf += num_words;
241 		return 0;
242 	}
243 	DRM_ERROR("Illegal termination of DMA command buffer\n");
244 	return 1;
245 }
246 
247 /*
248  * Partially stolen from drm_memory.h
249  */
250 
251 static __inline__ drm_local_map_t *via_drm_lookup_agp_map(drm_via_state_t *seq,
252 						    unsigned long offset,
253 						    unsigned long size,
254 						    struct drm_device *dev)
255 {
256 	struct drm_map_list *r_list;
257 	drm_local_map_t *map = seq->map_cache;
258 
259 	if (map && map->offset <= offset
260 	    && (offset + size) <= (map->offset + map->size)) {
261 		return map;
262 	}
263 
264 	list_for_each_entry(r_list, &dev->maplist, head) {
265 		map = r_list->map;
266 		if (!map)
267 			continue;
268 		if (map->offset <= offset
269 		    && (offset + size) <= (map->offset + map->size)
270 		    && !(map->flags & _DRM_RESTRICTED)
271 		    && (map->type == _DRM_AGP)) {
272 			seq->map_cache = map;
273 			return map;
274 		}
275 	}
276 	return NULL;
277 }
278 
279 /*
280  * Require that all AGP texture levels reside in the same AGP map which should
281  * be mappable by the client. This is not a big restriction.
282  * FIXME: To actually enforce this security policy strictly, drm_rmmap
283  * would have to wait for dma quiescent before removing an AGP map.
284  * The via_drm_lookup_agp_map call in reality seems to take
285  * very little CPU time.
286  */
287 
288 static __inline__ int finish_current_sequence(drm_via_state_t * cur_seq)
289 {
290 	switch (cur_seq->unfinished) {
291 	case z_address:
292 		DRM_DEBUG("Z Buffer start address is 0x%x\n", cur_seq->z_addr);
293 		break;
294 	case dest_address:
295 		DRM_DEBUG("Destination start address is 0x%x\n",
296 			  cur_seq->d_addr);
297 		break;
298 	case tex_address:
299 		if (cur_seq->agp_texture) {
300 			unsigned start =
301 			    cur_seq->tex_level_lo[cur_seq->texture];
302 			unsigned end = cur_seq->tex_level_hi[cur_seq->texture];
303 			unsigned long lo = ~0, hi = 0, tmp;
304 			uint32_t *addr, *pitch, *height, tex;
305 			unsigned i;
306 			int npot;
307 
308 			if (end > 9)
309 				end = 9;
310 			if (start > 9)
311 				start = 9;
312 
313 			addr =
314 			    &(cur_seq->t_addr[tex = cur_seq->texture][start]);
315 			pitch = &(cur_seq->pitch[tex][start]);
316 			height = &(cur_seq->height[tex][start]);
317 			npot = cur_seq->tex_npot[tex];
318 			for (i = start; i <= end; ++i) {
319 				tmp = *addr++;
320 				if (tmp < lo)
321 					lo = tmp;
322 				if (i == 0 && npot)
323 					tmp += (*height++ * *pitch++);
324 				else
325 					tmp += (*height++ << *pitch++);
326 				if (tmp > hi)
327 					hi = tmp;
328 			}
329 
330 			if (!via_drm_lookup_agp_map
331 			    (cur_seq, lo, hi - lo, cur_seq->dev)) {
332 				DRM_ERROR
333 				    ("AGP texture is not in allowed map\n");
334 				return 2;
335 			}
336 		}
337 		break;
338 	default:
339 		break;
340 	}
341 	cur_seq->unfinished = no_sequence;
342 	return 0;
343 }
344 
345 static __inline__ int
346 investigate_hazard(uint32_t cmd, hazard_t hz, drm_via_state_t *cur_seq)
347 {
348 	register uint32_t tmp, *tmp_addr;
349 
350 	if (cur_seq->unfinished && (cur_seq->unfinished != seqs[hz])) {
351 		int ret;
352 		if ((ret = finish_current_sequence(cur_seq)))
353 			return ret;
354 	}
355 
356 	switch (hz) {
357 	case check_for_header2:
358 		if (cmd == HALCYON_HEADER2)
359 			return 1;
360 		return 0;
361 	case check_for_header1:
362 		if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
363 			return 1;
364 		return 0;
365 	case check_for_header2_err:
366 		if (cmd == HALCYON_HEADER2)
367 			return 1;
368 		DRM_ERROR("Illegal DMA HALCYON_HEADER2 command\n");
369 		break;
370 	case check_for_header1_err:
371 		if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
372 			return 1;
373 		DRM_ERROR("Illegal DMA HALCYON_HEADER1 command\n");
374 		break;
375 	case check_for_fire:
376 		if ((cmd & HALCYON_FIREMASK) == HALCYON_FIRECMD)
377 			return 1;
378 		DRM_ERROR("Illegal DMA HALCYON_FIRECMD command\n");
379 		break;
380 	case check_for_dummy:
381 		if (HC_DUMMY == cmd)
382 			return 0;
383 		DRM_ERROR("Illegal DMA HC_DUMMY command\n");
384 		break;
385 	case check_for_dd:
386 		if (0xdddddddd == cmd)
387 			return 0;
388 		DRM_ERROR("Illegal DMA 0xdddddddd command\n");
389 		break;
390 	case check_z_buffer_addr0:
391 		cur_seq->unfinished = z_address;
392 		cur_seq->z_addr = (cur_seq->z_addr & 0xFF000000) |
393 		    (cmd & 0x00FFFFFF);
394 		return 0;
395 	case check_z_buffer_addr1:
396 		cur_seq->unfinished = z_address;
397 		cur_seq->z_addr = (cur_seq->z_addr & 0x00FFFFFF) |
398 		    ((cmd & 0xFF) << 24);
399 		return 0;
400 	case check_z_buffer_addr_mode:
401 		cur_seq->unfinished = z_address;
402 		if ((cmd & 0x0000C000) == 0)
403 			return 0;
404 		DRM_ERROR("Attempt to place Z buffer in system memory\n");
405 		return 2;
406 	case check_destination_addr0:
407 		cur_seq->unfinished = dest_address;
408 		cur_seq->d_addr = (cur_seq->d_addr & 0xFF000000) |
409 		    (cmd & 0x00FFFFFF);
410 		return 0;
411 	case check_destination_addr1:
412 		cur_seq->unfinished = dest_address;
413 		cur_seq->d_addr = (cur_seq->d_addr & 0x00FFFFFF) |
414 		    ((cmd & 0xFF) << 24);
415 		return 0;
416 	case check_destination_addr_mode:
417 		cur_seq->unfinished = dest_address;
418 		if ((cmd & 0x0000C000) == 0)
419 			return 0;
420 		DRM_ERROR
421 		    ("Attempt to place 3D drawing buffer in system memory\n");
422 		return 2;
423 	case check_texture_addr0:
424 		cur_seq->unfinished = tex_address;
425 		tmp = (cmd >> 24);
426 		tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
427 		*tmp_addr = (*tmp_addr & 0xFF000000) | (cmd & 0x00FFFFFF);
428 		return 0;
429 	case check_texture_addr1:
430 		cur_seq->unfinished = tex_address;
431 		tmp = ((cmd >> 24) - 0x20);
432 		tmp += tmp << 1;
433 		tmp_addr = &cur_seq->t_addr[cur_seq->texture][tmp];
434 		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
435 		tmp_addr++;
436 		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF00) << 16);
437 		tmp_addr++;
438 		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF0000) << 8);
439 		return 0;
440 	case check_texture_addr2:
441 		cur_seq->unfinished = tex_address;
442 		cur_seq->tex_level_lo[tmp = cur_seq->texture] = cmd & 0x3F;
443 		cur_seq->tex_level_hi[tmp] = (cmd & 0xFC0) >> 6;
444 		return 0;
445 	case check_texture_addr3:
446 		cur_seq->unfinished = tex_address;
447 		tmp = ((cmd >> 24) - HC_SubA_HTXnL0Pit);
448 		if (tmp == 0 &&
449 		    (cmd & HC_HTXnEnPit_MASK)) {
450 			cur_seq->pitch[cur_seq->texture][tmp] =
451 				(cmd & HC_HTXnLnPit_MASK);
452 			cur_seq->tex_npot[cur_seq->texture] = 1;
453 		} else {
454 			cur_seq->pitch[cur_seq->texture][tmp] =
455 				(cmd & HC_HTXnLnPitE_MASK) >> HC_HTXnLnPitE_SHIFT;
456 			cur_seq->tex_npot[cur_seq->texture] = 0;
457 			if (cmd & 0x000FFFFF) {
458 				DRM_ERROR
459 					("Unimplemented texture level 0 pitch mode.\n");
460 				return 2;
461 			}
462 		}
463 		return 0;
464 	case check_texture_addr4:
465 		cur_seq->unfinished = tex_address;
466 		tmp_addr = &cur_seq->t_addr[cur_seq->texture][9];
467 		*tmp_addr = (*tmp_addr & 0x00FFFFFF) | ((cmd & 0xFF) << 24);
468 		return 0;
469 	case check_texture_addr5:
470 	case check_texture_addr6:
471 		cur_seq->unfinished = tex_address;
472 		/*
473 		 * Texture width. We don't care since we have the pitch.
474 		 */
475 		return 0;
476 	case check_texture_addr7:
477 		cur_seq->unfinished = tex_address;
478 		tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
479 		tmp_addr[5] = 1 << ((cmd & 0x00F00000) >> 20);
480 		tmp_addr[4] = 1 << ((cmd & 0x000F0000) >> 16);
481 		tmp_addr[3] = 1 << ((cmd & 0x0000F000) >> 12);
482 		tmp_addr[2] = 1 << ((cmd & 0x00000F00) >> 8);
483 		tmp_addr[1] = 1 << ((cmd & 0x000000F0) >> 4);
484 		tmp_addr[0] = 1 << (cmd & 0x0000000F);
485 		return 0;
486 	case check_texture_addr8:
487 		cur_seq->unfinished = tex_address;
488 		tmp_addr = &(cur_seq->height[cur_seq->texture][0]);
489 		tmp_addr[9] = 1 << ((cmd & 0x0000F000) >> 12);
490 		tmp_addr[8] = 1 << ((cmd & 0x00000F00) >> 8);
491 		tmp_addr[7] = 1 << ((cmd & 0x000000F0) >> 4);
492 		tmp_addr[6] = 1 << (cmd & 0x0000000F);
493 		return 0;
494 	case check_texture_addr_mode:
495 		cur_seq->unfinished = tex_address;
496 		if (2 == (tmp = cmd & 0x00000003)) {
497 			DRM_ERROR
498 			    ("Attempt to fetch texture from system memory.\n");
499 			return 2;
500 		}
501 		cur_seq->agp_texture = (tmp == 3);
502 		cur_seq->tex_palette_size[cur_seq->texture] =
503 		    (cmd >> 16) & 0x000000007;
504 		return 0;
505 	case check_for_vertex_count:
506 		cur_seq->vertex_count = cmd & 0x0000FFFF;
507 		return 0;
508 	case check_number_texunits:
509 		cur_seq->multitex = (cmd >> 3) & 1;
510 		return 0;
511 	default:
512 		DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
513 		return 2;
514 	}
515 	return 2;
516 }
517 
518 static __inline__ int
519 via_check_prim_list(uint32_t const **buffer, const uint32_t * buf_end,
520 		    drm_via_state_t *cur_seq)
521 {
522 	drm_via_private_t *dev_priv =
523 	    (drm_via_private_t *) cur_seq->dev->dev_private;
524 	uint32_t a_fire, bcmd, dw_count;
525 	int ret = 0;
526 	int have_fire;
527 	const uint32_t *buf = *buffer;
528 
529 	while (buf < buf_end) {
530 		have_fire = 0;
531 		if ((buf_end - buf) < 2) {
532 			DRM_ERROR
533 			    ("Unexpected termination of primitive list.\n");
534 			ret = 1;
535 			break;
536 		}
537 		if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdB)
538 			break;
539 		bcmd = *buf++;
540 		if ((*buf & HC_ACMD_MASK) != HC_ACMD_HCmdA) {
541 			DRM_ERROR("Expected Vertex List A command, got 0x%x\n",
542 				  *buf);
543 			ret = 1;
544 			break;
545 		}
546 		a_fire =
547 		    *buf++ | HC_HPLEND_MASK | HC_HPMValidN_MASK |
548 		    HC_HE3Fire_MASK;
549 
550 		/*
551 		 * How many dwords per vertex ?
552 		 */
553 
554 		if (cur_seq->agp && ((bcmd & (0xF << 11)) == 0)) {
555 			DRM_ERROR("Illegal B command vertex data for AGP.\n");
556 			ret = 1;
557 			break;
558 		}
559 
560 		dw_count = 0;
561 		if (bcmd & (1 << 7))
562 			dw_count += (cur_seq->multitex) ? 2 : 1;
563 		if (bcmd & (1 << 8))
564 			dw_count += (cur_seq->multitex) ? 2 : 1;
565 		if (bcmd & (1 << 9))
566 			dw_count++;
567 		if (bcmd & (1 << 10))
568 			dw_count++;
569 		if (bcmd & (1 << 11))
570 			dw_count++;
571 		if (bcmd & (1 << 12))
572 			dw_count++;
573 		if (bcmd & (1 << 13))
574 			dw_count++;
575 		if (bcmd & (1 << 14))
576 			dw_count++;
577 
578 		while (buf < buf_end) {
579 			if (*buf == a_fire) {
580 				if (dev_priv->num_fire_offsets >=
581 				    VIA_FIRE_BUF_SIZE) {
582 					DRM_ERROR("Fire offset buffer full.\n");
583 					ret = 1;
584 					break;
585 				}
586 				dev_priv->fire_offsets[dev_priv->
587 						       num_fire_offsets++] =
588 				    buf;
589 				have_fire = 1;
590 				buf++;
591 				if (buf < buf_end && *buf == a_fire)
592 					buf++;
593 				break;
594 			}
595 			if ((*buf == HALCYON_HEADER2) ||
596 			    ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) {
597 				DRM_ERROR("Missing Vertex Fire command, "
598 					  "Stray Vertex Fire command  or verifier "
599 					  "lost sync.\n");
600 				ret = 1;
601 				break;
602 			}
603 			if ((ret = eat_words(&buf, buf_end, dw_count)))
604 				break;
605 		}
606 		if (buf >= buf_end && !have_fire) {
607 			DRM_ERROR("Missing Vertex Fire command or verifier "
608 				  "lost sync.\n");
609 			ret = 1;
610 			break;
611 		}
612 		if (cur_seq->agp && ((buf - cur_seq->buf_start) & 0x01)) {
613 			DRM_ERROR("AGP Primitive list end misaligned.\n");
614 			ret = 1;
615 			break;
616 		}
617 	}
618 	*buffer = buf;
619 	return ret;
620 }
621 
622 static __inline__ verifier_state_t
623 via_check_header2(uint32_t const **buffer, const uint32_t *buf_end,
624 		  drm_via_state_t *hc_state)
625 {
626 	uint32_t cmd;
627 	int hz_mode;
628 	hazard_t hz;
629 	const uint32_t *buf = *buffer;
630 	const hazard_t *hz_table;
631 
632 	if ((buf_end - buf) < 2) {
633 		DRM_ERROR
634 		    ("Illegal termination of DMA HALCYON_HEADER2 sequence.\n");
635 		return state_error;
636 	}
637 	buf++;
638 	cmd = (*buf++ & 0xFFFF0000) >> 16;
639 
640 	switch (cmd) {
641 	case HC_ParaType_CmdVdata:
642 		if (via_check_prim_list(&buf, buf_end, hc_state))
643 			return state_error;
644 		*buffer = buf;
645 		return state_command;
646 	case HC_ParaType_NotTex:
647 		hz_table = table1;
648 		break;
649 	case HC_ParaType_Tex:
650 		hc_state->texture = 0;
651 		hz_table = table2;
652 		break;
653 	case (HC_ParaType_Tex | (HC_SubType_Tex1 << 8)):
654 		hc_state->texture = 1;
655 		hz_table = table2;
656 		break;
657 	case (HC_ParaType_Tex | (HC_SubType_TexGeneral << 8)):
658 		hz_table = table3;
659 		break;
660 	case HC_ParaType_Auto:
661 		if (eat_words(&buf, buf_end, 2))
662 			return state_error;
663 		*buffer = buf;
664 		return state_command;
665 	case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
666 		if (eat_words(&buf, buf_end, 32))
667 			return state_error;
668 		*buffer = buf;
669 		return state_command;
670 	case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
671 	case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
672 		DRM_ERROR("Texture palettes are rejected because of "
673 			  "lack of info how to determine their size.\n");
674 		return state_error;
675 	case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
676 		DRM_ERROR("Fog factor palettes are rejected because of "
677 			  "lack of info how to determine their size.\n");
678 		return state_error;
679 	default:
680 
681 		/*
682 		 * There are some unimplemented HC_ParaTypes here, that
683 		 * need to be implemented if the Mesa driver is extended.
684 		 */
685 
686 		DRM_ERROR("Invalid or unimplemented HALCYON_HEADER2 "
687 			  "DMA subcommand: 0x%x. Previous dword: 0x%x\n",
688 			  cmd, *(buf - 2));
689 		*buffer = buf;
690 		return state_error;
691 	}
692 
693 	while (buf < buf_end) {
694 		cmd = *buf++;
695 		if ((hz = hz_table[cmd >> 24])) {
696 			if ((hz_mode = investigate_hazard(cmd, hz, hc_state))) {
697 				if (hz_mode == 1) {
698 					buf--;
699 					break;
700 				}
701 				return state_error;
702 			}
703 		} else if (hc_state->unfinished &&
704 			   finish_current_sequence(hc_state)) {
705 			return state_error;
706 		}
707 	}
708 	if (hc_state->unfinished && finish_current_sequence(hc_state))
709 		return state_error;
710 	*buffer = buf;
711 	return state_command;
712 }
713 
714 static __inline__ verifier_state_t
715 via_parse_header2(drm_via_private_t *dev_priv, uint32_t const **buffer,
716 		  const uint32_t *buf_end, int *fire_count)
717 {
718 	uint32_t cmd;
719 	const uint32_t *buf = *buffer;
720 	const uint32_t *next_fire;
721 	int burst = 0;
722 
723 	next_fire = dev_priv->fire_offsets[*fire_count];
724 	buf++;
725 	cmd = (*buf & 0xFFFF0000) >> 16;
726 	VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++);
727 	switch (cmd) {
728 	case HC_ParaType_CmdVdata:
729 		while ((buf < buf_end) &&
730 		       (*fire_count < dev_priv->num_fire_offsets) &&
731 		       (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB) {
732 			while (buf <= next_fire) {
733 				VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
734 					  (burst & 63), *buf++);
735 				burst += 4;
736 			}
737 			if ((buf < buf_end)
738 			    && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
739 				buf++;
740 
741 			if (++(*fire_count) < dev_priv->num_fire_offsets)
742 				next_fire = dev_priv->fire_offsets[*fire_count];
743 		}
744 		break;
745 	default:
746 		while (buf < buf_end) {
747 
748 			if (*buf == HC_HEADER2 ||
749 			    (*buf & HALCYON_HEADER1MASK) == HALCYON_HEADER1 ||
750 			    (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5 ||
751 			    (*buf & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
752 				break;
753 
754 			VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE +
755 				  (burst & 63), *buf++);
756 			burst += 4;
757 		}
758 	}
759 	*buffer = buf;
760 	return state_command;
761 }
762 
763 static __inline__ int verify_mmio_address(uint32_t address)
764 {
765 	if ((address > 0x3FF) && (address < 0xC00)) {
766 		DRM_ERROR("Invalid VIDEO DMA command. "
767 			  "Attempt to access 3D- or command burst area.\n");
768 		return 1;
769 	} else if ((address > 0xCFF) && (address < 0x1300)) {
770 		DRM_ERROR("Invalid VIDEO DMA command. "
771 			  "Attempt to access PCI DMA area.\n");
772 		return 1;
773 	} else if (address > 0x13FF) {
774 		DRM_ERROR("Invalid VIDEO DMA command. "
775 			  "Attempt to access VGA registers.\n");
776 		return 1;
777 	}
778 	return 0;
779 }
780 
781 static __inline__ int
782 verify_video_tail(uint32_t const **buffer, const uint32_t * buf_end,
783 		  uint32_t dwords)
784 {
785 	const uint32_t *buf = *buffer;
786 
787 	if (buf_end - buf < dwords) {
788 		DRM_ERROR("Illegal termination of video command.\n");
789 		return 1;
790 	}
791 	while (dwords--) {
792 		if (*buf++) {
793 			DRM_ERROR("Illegal video command tail.\n");
794 			return 1;
795 		}
796 	}
797 	*buffer = buf;
798 	return 0;
799 }
800 
801 static __inline__ verifier_state_t
802 via_check_header1(uint32_t const **buffer, const uint32_t * buf_end)
803 {
804 	uint32_t cmd;
805 	const uint32_t *buf = *buffer;
806 	verifier_state_t ret = state_command;
807 
808 	while (buf < buf_end) {
809 		cmd = *buf;
810 		if ((cmd > ((0x3FF >> 2) | HALCYON_HEADER1)) &&
811 		    (cmd < ((0xC00 >> 2) | HALCYON_HEADER1))) {
812 			if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
813 				break;
814 			DRM_ERROR("Invalid HALCYON_HEADER1 command. "
815 				  "Attempt to access 3D- or command burst area.\n");
816 			ret = state_error;
817 			break;
818 		} else if (cmd > ((0xCFF >> 2) | HALCYON_HEADER1)) {
819 			if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
820 				break;
821 			DRM_ERROR("Invalid HALCYON_HEADER1 command. "
822 				  "Attempt to access VGA registers.\n");
823 			ret = state_error;
824 			break;
825 		} else {
826 			buf += 2;
827 		}
828 	}
829 	*buffer = buf;
830 	return ret;
831 }
832 
833 static __inline__ verifier_state_t
834 via_parse_header1(drm_via_private_t *dev_priv, uint32_t const **buffer,
835 		  const uint32_t *buf_end)
836 {
837 	register uint32_t cmd;
838 	const uint32_t *buf = *buffer;
839 
840 	while (buf < buf_end) {
841 		cmd = *buf;
842 		if ((cmd & HALCYON_HEADER1MASK) != HALCYON_HEADER1)
843 			break;
844 		VIA_WRITE((cmd & ~HALCYON_HEADER1MASK) << 2, *++buf);
845 		buf++;
846 	}
847 	*buffer = buf;
848 	return state_command;
849 }
850 
851 static __inline__ verifier_state_t
852 via_check_vheader5(uint32_t const **buffer, const uint32_t *buf_end)
853 {
854 	uint32_t data;
855 	const uint32_t *buf = *buffer;
856 
857 	if (buf_end - buf < 4) {
858 		DRM_ERROR("Illegal termination of video header5 command\n");
859 		return state_error;
860 	}
861 
862 	data = *buf++ & ~VIA_VIDEOMASK;
863 	if (verify_mmio_address(data))
864 		return state_error;
865 
866 	data = *buf++;
867 	if (*buf++ != 0x00F50000) {
868 		DRM_ERROR("Illegal header5 header data\n");
869 		return state_error;
870 	}
871 	if (*buf++ != 0x00000000) {
872 		DRM_ERROR("Illegal header5 header data\n");
873 		return state_error;
874 	}
875 	if (eat_words(&buf, buf_end, data))
876 		return state_error;
877 	if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
878 		return state_error;
879 	*buffer = buf;
880 	return state_command;
881 
882 }
883 
884 static __inline__ verifier_state_t
885 via_parse_vheader5(drm_via_private_t *dev_priv, uint32_t const **buffer,
886 		   const uint32_t *buf_end)
887 {
888 	uint32_t addr, count, i;
889 	const uint32_t *buf = *buffer;
890 
891 	addr = *buf++ & ~VIA_VIDEOMASK;
892 	i = count = *buf;
893 	buf += 3;
894 	while (i--)
895 		VIA_WRITE(addr, *buf++);
896 	if (count & 3)
897 		buf += 4 - (count & 3);
898 	*buffer = buf;
899 	return state_command;
900 }
901 
902 static __inline__ verifier_state_t
903 via_check_vheader6(uint32_t const **buffer, const uint32_t * buf_end)
904 {
905 	uint32_t data;
906 	const uint32_t *buf = *buffer;
907 	uint32_t i;
908 
909 	if (buf_end - buf < 4) {
910 		DRM_ERROR("Illegal termination of video header6 command\n");
911 		return state_error;
912 	}
913 	buf++;
914 	data = *buf++;
915 	if (*buf++ != 0x00F60000) {
916 		DRM_ERROR("Illegal header6 header data\n");
917 		return state_error;
918 	}
919 	if (*buf++ != 0x00000000) {
920 		DRM_ERROR("Illegal header6 header data\n");
921 		return state_error;
922 	}
923 	if ((buf_end - buf) < (data << 1)) {
924 		DRM_ERROR("Illegal termination of video header6 command\n");
925 		return state_error;
926 	}
927 	for (i = 0; i < data; ++i) {
928 		if (verify_mmio_address(*buf++))
929 			return state_error;
930 		buf++;
931 	}
932 	data <<= 1;
933 	if ((data & 3) && verify_video_tail(&buf, buf_end, 4 - (data & 3)))
934 		return state_error;
935 	*buffer = buf;
936 	return state_command;
937 }
938 
939 static __inline__ verifier_state_t
940 via_parse_vheader6(drm_via_private_t *dev_priv, uint32_t const **buffer,
941 		   const uint32_t *buf_end)
942 {
943 
944 	uint32_t addr, count, i;
945 	const uint32_t *buf = *buffer;
946 
947 	i = count = *++buf;
948 	buf += 3;
949 	while (i--) {
950 		addr = *buf++;
951 		VIA_WRITE(addr, *buf++);
952 	}
953 	count <<= 1;
954 	if (count & 3)
955 		buf += 4 - (count & 3);
956 	*buffer = buf;
957 	return state_command;
958 }
959 
960 int
961 via_verify_command_stream(const uint32_t * buf, unsigned int size,
962 			  struct drm_device * dev, int agp)
963 {
964 
965 	drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
966 	drm_via_state_t *hc_state = &dev_priv->hc_state;
967 	drm_via_state_t saved_state = *hc_state;
968 	uint32_t cmd;
969 	const uint32_t *buf_end = buf + (size >> 2);
970 	verifier_state_t state = state_command;
971 	int cme_video;
972 	int supported_3d;
973 
974 	cme_video = (dev_priv->chipset == VIA_PRO_GROUP_A ||
975 		     dev_priv->chipset == VIA_DX9_0);
976 
977 	supported_3d = dev_priv->chipset != VIA_DX9_0;
978 
979 	hc_state->dev = dev;
980 	hc_state->unfinished = no_sequence;
981 	hc_state->map_cache = NULL;
982 	hc_state->agp = agp;
983 	hc_state->buf_start = buf;
984 	dev_priv->num_fire_offsets = 0;
985 
986 	while (buf < buf_end) {
987 
988 		switch (state) {
989 		case state_header2:
990 			state = via_check_header2(&buf, buf_end, hc_state);
991 			break;
992 		case state_header1:
993 			state = via_check_header1(&buf, buf_end);
994 			break;
995 		case state_vheader5:
996 			state = via_check_vheader5(&buf, buf_end);
997 			break;
998 		case state_vheader6:
999 			state = via_check_vheader6(&buf, buf_end);
1000 			break;
1001 		case state_command:
1002 			if ((HALCYON_HEADER2 == (cmd = *buf)) &&
1003 			    supported_3d)
1004 				state = state_header2;
1005 			else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1006 				state = state_header1;
1007 			else if (cme_video
1008 				 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1009 				state = state_vheader5;
1010 			else if (cme_video
1011 				 && (cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1012 				state = state_vheader6;
1013 			else if ((cmd == HALCYON_HEADER2) && !supported_3d) {
1014 				DRM_ERROR("Accelerated 3D is not supported on this chipset yet.\n");
1015 				state = state_error;
1016 			} else {
1017 				DRM_ERROR
1018 				    ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1019 				     cmd);
1020 				state = state_error;
1021 			}
1022 			break;
1023 		case state_error:
1024 		default:
1025 			*hc_state = saved_state;
1026 			return -EINVAL;
1027 		}
1028 	}
1029 	if (state == state_error) {
1030 		*hc_state = saved_state;
1031 		return -EINVAL;
1032 	}
1033 	return 0;
1034 }
1035 
1036 int
1037 via_parse_command_stream(struct drm_device *dev, const uint32_t *buf,
1038 			 unsigned int size)
1039 {
1040 
1041 	drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
1042 	uint32_t cmd;
1043 	const uint32_t *buf_end = buf + (size >> 2);
1044 	verifier_state_t state = state_command;
1045 	int fire_count = 0;
1046 
1047 	while (buf < buf_end) {
1048 
1049 		switch (state) {
1050 		case state_header2:
1051 			state =
1052 			    via_parse_header2(dev_priv, &buf, buf_end,
1053 					      &fire_count);
1054 			break;
1055 		case state_header1:
1056 			state = via_parse_header1(dev_priv, &buf, buf_end);
1057 			break;
1058 		case state_vheader5:
1059 			state = via_parse_vheader5(dev_priv, &buf, buf_end);
1060 			break;
1061 		case state_vheader6:
1062 			state = via_parse_vheader6(dev_priv, &buf, buf_end);
1063 			break;
1064 		case state_command:
1065 			if (HALCYON_HEADER2 == (cmd = *buf))
1066 				state = state_header2;
1067 			else if ((cmd & HALCYON_HEADER1MASK) == HALCYON_HEADER1)
1068 				state = state_header1;
1069 			else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER5)
1070 				state = state_vheader5;
1071 			else if ((cmd & VIA_VIDEOMASK) == VIA_VIDEO_HEADER6)
1072 				state = state_vheader6;
1073 			else {
1074 				DRM_ERROR
1075 				    ("Invalid / Unimplemented DMA HEADER command. 0x%x\n",
1076 				     cmd);
1077 				state = state_error;
1078 			}
1079 			break;
1080 		case state_error:
1081 		default:
1082 			return -EINVAL;
1083 		}
1084 	}
1085 	if (state == state_error)
1086 		return -EINVAL;
1087 	return 0;
1088 }
1089 
1090 static void
1091 setup_hazard_table(hz_init_t init_table[], hazard_t table[], int size)
1092 {
1093 	int i;
1094 
1095 	for (i = 0; i < 256; ++i)
1096 		table[i] = forbidden_command;
1097 
1098 	for (i = 0; i < size; ++i)
1099 		table[init_table[i].code] = init_table[i].hz;
1100 }
1101 
1102 void via_init_command_verifier(void)
1103 {
1104 	setup_hazard_table(init_table1, table1,
1105 			   sizeof(init_table1) / sizeof(hz_init_t));
1106 	setup_hazard_table(init_table2, table2,
1107 			   sizeof(init_table2) / sizeof(hz_init_t));
1108 	setup_hazard_table(init_table3, table3,
1109 			   sizeof(init_table3) / sizeof(hz_init_t));
1110 }
1111