diff options
Diffstat (limited to 'shared-core')
| -rw-r--r-- | shared-core/via_drv.h | 4 | ||||
| -rw-r--r-- | shared-core/via_verifier.c | 51 |
2 files changed, 42 insertions, 13 deletions
diff --git a/shared-core/via_drv.h b/shared-core/via_drv.h index b2422fcf..48a93f78 100644 --- a/shared-core/via_drv.h +++ b/shared-core/via_drv.h @@ -28,11 +28,11 @@ #define DRIVER_NAME "via" #define DRIVER_DESC "VIA Unichrome" -#define DRIVER_DATE "20041221" +#define DRIVER_DATE "20041231" #define DRIVER_MAJOR 2 #define DRIVER_MINOR 3 -#define DRIVER_PATCHLEVEL 3 +#define DRIVER_PATCHLEVEL 4 typedef struct drm_via_ring_buffer { drm_map_t map; diff --git a/shared-core/via_verifier.c b/shared-core/via_verifier.c index b3654eed..c60c911f 100644 --- a/shared-core/via_verifier.c +++ b/shared-core/via_verifier.c @@ -250,6 +250,7 @@ typedef struct{ uint32_t height[2][10]; uint32_t tex_level_lo[2]; uint32_t tex_level_hi[2]; + uint32_t tex_palette_size[2]; sequence_t unfinished; int agp_texture; drm_device_t *dev; @@ -258,6 +259,19 @@ typedef struct{ static sequence_context_t hc_sequence; + +static __inline__ int +eat_words(const uint32_t **buf, const uint32_t *buf_end, unsigned num_words) +{ + if ((*buf - buf_end) >= num_words) { + *buf += num_words; + return 0; + } + DRM_ERROR("Illegal termination of DMA command buffer\n"); + return 1; +} + + /* * Partially stolen from drm_memory.h */ @@ -474,12 +488,14 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq) return 0; case check_texture_addr_mode: cur_seq->unfinished = tex_address; - if ( 2 != (tmp = cmd & 0x00000003)) { - cur_seq->agp_texture = (tmp == 3); - return 0; + if ( 2 == (tmp = cmd & 0x00000003)) { + DRM_ERROR("Attempt to fetch texture from system memory.\n"); + return 2; } - DRM_ERROR("Attempt to fetch texture from system memory.\n"); - return 2; + cur_seq->agp_texture = (tmp == 3); + cur_seq->tex_palette_size[cur_seq->texture] = + (cmd >> 16) & 0x000000007; + return 0; default: DRM_ERROR("Illegal DMA data: 0x%x\n", cmd); return 2; @@ -488,8 +504,6 @@ investigate_hazard( uint32_t cmd, hazard_t hz, sequence_context_t *cur_seq) } - - static __inline__ verifier_state_t via_check_header2( uint32_t const **buffer, const uint32_t *buf_end ) { @@ -512,8 +526,8 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end ) /* * Command vertex data. * It is assumed that the command regulator remains in this state - * until it encounters a double fire command or a header2 data. - * CHECK: Could vertex data accidently be header2 or fire? + * until it encounters a possibly double fire command or a header2 data. + * FIXME: Vertex data can accidently be header2 or fire. * CHECK: What does the regulator do if it encounters a header1 * cmd? */ @@ -526,7 +540,7 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end ) ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) buf++; if ((buf < buf_end) && - ((*buf & HALCYON_CMDBMASK) != HC_ACMD_HCmdB)) + ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) break; } buf++; @@ -549,9 +563,24 @@ via_check_header2( uint32_t const **buffer, const uint32_t *buf_end ) hz_table = table3; break; case HC_ParaType_Auto: - buf += 2; + if (eat_words(&buf, buf_end, 2)) + return state_error; *buffer = buf; return state_command; + case (HC_ParaType_Palette | (HC_SubType_Stipple << 8)): + if (eat_words(&buf, buf_end, 32)) + return state_error; + *buffer = buf; + return state_command; + case (HC_ParaType_Palette | (HC_SubType_TexPalette0 << 8)): + case (HC_ParaType_Palette | (HC_SubType_TexPalette1 << 8)): + DRM_ERROR("Texture palettes are rejected because of " + "lack of info how to determine their size.\n"); + return state_error; + case (HC_ParaType_Palette | (HC_SubType_FogTable << 8)): + DRM_ERROR("Fog factor palettes are rejected because of " + "lack of info how to determine their size.\n"); + return state_error; default: /* |