summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--shared-core/via_drv.h4
-rw-r--r--shared-core/via_verifier.c51
-rw-r--r--shared/via.h4
-rw-r--r--shared/via_verifier.c53
4 files changed, 85 insertions, 27 deletions
diff --git a/shared-core/via_drv.h b/shared-core/via_drv.h
index b2422fcf..48a93f78 100644
--- a/shared-core/via_drv.h
+++ b/shared-core/via_drv.h
@@ -28,11 +28,11 @@
#define DRIVER_NAME "via"
#define DRIVER_DESC "VIA Unichrome"
-#define DRIVER_DATE "20041221"
+#define DRIVER_DATE "20041231"
#define DRIVER_MAJOR 2
#define DRIVER_MINOR 3
-#define DRIVER_PATCHLEVEL 3
+#define DRIVER_PATCHLEVEL 4
typedef struct drm_via_ring_buffer {
drm_map_t map;
diff --git a/shared-core/via_verifier.c b/shared-core/via_verifier.c
index b3654eed..c60c911f 100644
--- a/shared-core/via_verifier.c
+++ b/shared-core/via_verifier.c
@@ -250,6 +250,7 @@ typedef struct{
uint32_t height[2][10];
uint32_t tex_level_lo[2];
uint32_t tex_level_hi[2];
+ uint32_t tex_palette_size[2];
sequence_t unfinished;
int agp_texture;
drm_device_t *dev;
@@ -258,6 +259,19 @@ typedef struct{
static sequence_context_t hc_sequence;
+
+static __inline__ int
+eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
+{
+ if ((*buf - buf_end) >= num_words) {
+ *buf += num_words;
+ return 0;
+ }
+ DRM_ERROR("Illegal termination of DMA command buffer\n");
+ return 1;
+}
+
+
/*
* Partially stolen from drm_memory.h
*/
@@ -474,12 +488,14 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq)
return 0;
case check_texture_addr_mode:
cur_seq->unfinished = tex_address;
- if ( 2 != (tmp = cmd & 0x00000003)) {
- cur_seq->agp_texture = (tmp == 3);
- return 0;
+ if ( 2 == (tmp = cmd & 0x00000003)) {
+ DRM_ERROR("Attempt to fetch texture from system memory.\n");
+ return 2;
}
- DRM_ERROR("Attempt to fetch texture from system memory.\n");
- return 2;
+ cur_seq->agp_texture = (tmp == 3);
+ cur_seq->tex_palette_size[cur_seq->texture] =
+ (cmd >> 16) & 0x000000007;
+ return 0;
default:
DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
return 2;
@@ -488,8 +504,6 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq)
}
-
-
static __inline__ verifier_state_t
via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
{
@@ -512,8 +526,8 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
/*
* Command vertex data.
* It is assumed that the command regulator remains in this state
- * until it encounters a double fire command or a header2 data.
- * CHECK: Could vertex data accidently be header2 or fire?
+ * until it encounters a possibly double fire command or a header2 data.
+ * FIXME: Vertex data can accidently be header2 or fire.
* CHECK: What does the regulator do if it encounters a header1
* cmd?
*/
@@ -526,7 +540,7 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
buf++;
if ((buf < buf_end) &&
- ((*buf & HALCYON_CMDBMASK) != HC_ACMD_HCmdB))
+ ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
break;
}
buf++;
@@ -549,9 +563,24 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
hz_table = table3;
break;
case HC_ParaType_Auto:
- buf += 2;
+ if (eat_words(&buf, buf_end, 2))
+ return state_error;
*buffer = buf;
return state_command;
+ case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
+ if (eat_words(&buf, buf_end, 32))
+ return state_error;
+ *buffer = buf;
+ return state_command;
+ case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
+ case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
+ DRM_ERROR("Texture palettes are rejected because of "
+ "lack of info how to determine their size.\n");
+ return state_error;
+ case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
+ DRM_ERROR("Fog factor palettes are rejected because of "
+ "lack of info how to determine their size.\n");
+ return state_error;
default:
/*
diff --git a/shared/via.h b/shared/via.h
index 2811d786..1e253771 100644
--- a/shared/via.h
+++ b/shared/via.h
@@ -30,11 +30,11 @@
#define DRIVER_NAME "via"
#define DRIVER_DESC "VIA Unichrome"
-#define DRIVER_DATE "20041221"
+#define DRIVER_DATE "20041231"
#define DRIVER_MAJOR 2
#define DRIVER_MINOR 3
-#define DRIVER_PATCHLEVEL 3
+#define DRIVER_PATCHLEVEL 4
#define DRIVER_IOCTLS \
[DRM_IOCTL_NR(DRM_IOCTL_VIA_ALLOCMEM)] = { via_mem_alloc, 1, 0 }, \
diff --git a/shared/via_verifier.c b/shared/via_verifier.c
index e29725bf..355a64ff 100644
--- a/shared/via_verifier.c
+++ b/shared/via_verifier.c
@@ -28,8 +28,8 @@
*/
-#include "via_3d_reg.h"
#include "via.h"
+#include "via_3d_reg.h"
#include "drmP.h"
typedef enum{
@@ -251,6 +251,7 @@ typedef struct{
uint32_t height[2][10];
uint32_t tex_level_lo[2];
uint32_t tex_level_hi[2];
+ uint32_t tex_palette_size[2];
sequence_t unfinished;
int agp_texture;
drm_device_t *dev;
@@ -259,6 +260,19 @@ typedef struct{
static sequence_context_t hc_sequence;
+
+static __inline__ int
+eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words)
+{
+ if ((*buf - buf_end) >= num_words) {
+ *buf += num_words;
+ return 0;
+ }
+ DRM_ERROR("Illegal termination of DMA command buffer\n");
+ return 1;
+}
+
+
/*
* Partially stolen from drm_memory.h
*/
@@ -475,12 +489,14 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq)
return 0;
case check_texture_addr_mode:
cur_seq->unfinished = tex_address;
- if ( 2 != (tmp = cmd & 0x00000003)) {
- cur_seq->agp_texture = (tmp == 3);
- return 0;
+ if ( 2 == (tmp = cmd & 0x00000003)) {
+ DRM_ERROR("Attempt to fetch texture from system memory.\n");
+ return 2;
}
- DRM_ERROR("Attempt to fetch texture from system memory.\n");
- return 2;
+ cur_seq->agp_texture = (tmp == 3);
+ cur_seq->tex_palette_size[cur_seq->texture] =
+ (cmd >> 16) & 0x000000007;
+ return 0;
default:
DRM_ERROR("Illegal DMA data: 0x%x\n", cmd);
return 2;
@@ -489,8 +505,6 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq)
}
-
-
static __inline__ verifier_state_t
via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
{
@@ -513,8 +527,8 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
/*
* Command vertex data.
* It is assumed that the command regulator remains in this state
- * until it encounters a double fire command or a header2 data.
- * CHECK: Could vertex data accidently be header2 or fire?
+ * until it encounters a possibly double fire command or a header2 data.
+ * FIXME: Vertex data can accidently be header2 or fire.
* CHECK: What does the regulator do if it encounters a header1
* cmd?
*/
@@ -527,7 +541,7 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
buf++;
if ((buf < buf_end) &&
- ((*buf & HALCYON_CMDBMASK) != HC_ACMD_HCmdB))
+ ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD))
break;
}
buf++;
@@ -550,9 +564,24 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end )
hz_table = table3;
break;
case HC_ParaType_Auto:
- buf += 2;
+ if (eat_words(&buf, buf_end, 2))
+ return state_error;
*buffer = buf;
return state_command;
+ case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)):
+ if (eat_words(&buf, buf_end, 32))
+ return state_error;
+ *buffer = buf;
+ return state_command;
+ case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)):
+ case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)):
+ DRM_ERROR("Texture palettes are rejected because of "
+ "lack of info how to determine their size.\n");
+ return state_error;
+ case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)):
+ DRM_ERROR("Fog factor palettes are rejected because of "
+ "lack of info how to determine their size.\n");
+ return state_error;
default:
/*
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-25 05:30:05 +0000