openkylin
/
platform_kernel-5.15
mirror of https://gitee.com/openkylin/platform_kernel-5.15.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

drm: fix a LOR issue on FreeBSD for savage driver 

Correct a LOR issue on FreeBSD by allocating temporary space and doing a single
DRM_COPY_FROM_USER rather than DRM_VERIFYAREA_READ followed by tons of
DRM_COPY_FROM_USER_UNCHECKED.  I don't like the look of the temporary space
allocation, but I like the simplification in the rest of the file.  Tested
with glxgears, tuxracer, and q3 on a savage4.

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>
This commit is contained in:
Dave Airlie 2006-01-02 16:11:44 +11:00 committed by Dave Airlie
parent 952d751a14
commit 3528af1b18
2 changed files with 171 additions and 176 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/char/drm/savage_drv.h
View File

@ -1,5 +1,5 @@
/* savage_drv.h -- Private header for the savage driver /* savage_drv.h -- Private header for the savage driver */
* /*
* Copyright 2004 Felix Kuehling * Copyright 2004 Felix Kuehling
* All Rights Reserved. * All Rights Reserved.
* *
@ -192,7 +192,7 @@ typedef struct drm_savage_private {
/* Err, there is a macro wait_event in include/linux/wait.h. /* Err, there is a macro wait_event in include/linux/wait.h.
* Avoid unwanted macro expansion. */ * Avoid unwanted macro expansion. */
void (*emit_clip_rect) (struct drm_savage_private * dev_priv, void (*emit_clip_rect) (struct drm_savage_private * dev_priv,
drm_clip_rect_t * pbox); const drm_clip_rect_t * pbox);
void (*dma_flush) (struct drm_savage_private * dev_priv); void (*dma_flush) (struct drm_savage_private * dev_priv);
} drm_savage_private_t; } drm_savage_private_t;
@ -217,9 +217,9 @@ extern void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp);
/* state functions */ /* state functions */
extern void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv, extern void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
drm_clip_rect_t * pbox); const drm_clip_rect_t * pbox);
extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv, extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
drm_clip_rect_t * pbox); const drm_clip_rect_t * pbox);
#define SAVAGE_FB_SIZE_S3 0x01000000 /* 16MB */ #define SAVAGE_FB_SIZE_S3 0x01000000 /* 16MB */
#define SAVAGE_FB_SIZE_S4 0x02000000 /* 32MB */ #define SAVAGE_FB_SIZE_S4 0x02000000 /* 32MB */
@ -502,15 +502,6 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
#define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val) #define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)
#define BCI_COPY_FROM_USER(src,n) do { \
unsigned int i; \
for (i = 0; i < n; ++i) { \
uint32_t val; \
DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]); \
BCI_WRITE(val); \
} \
} while(0)
/* /*
* command DMA support * command DMA support
*/ */
@ -536,8 +527,8 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
#define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val) #define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)
#define DMA_COPY_FROM_USER(src,n) do { \ #define DMA_COPY(src, n) do { \
DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4); \ memcpy(dma_ptr, (src), (n)*4); \
dma_ptr += n; \ dma_ptr += n; \
} while(0) } while(0)

324
drivers/char/drm/savage_state.c
View File

@ -27,7 +27,7 @@
#include "savage_drv.h" #include "savage_drv.h"
void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv, void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
drm_clip_rect_t * pbox) const drm_clip_rect_t * pbox)
{ {
uint32_t scstart = dev_priv->state.s3d.new_scstart; uint32_t scstart = dev_priv->state.s3d.new_scstart;
uint32_t scend = dev_priv->state.s3d.new_scend; uint32_t scend = dev_priv->state.s3d.new_scend;
@ -53,7 +53,7 @@ void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
} }
void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv, void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
drm_clip_rect_t * pbox) const drm_clip_rect_t * pbox)
{ {
uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0; uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0;
uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1; uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1;
@ -115,18 +115,19 @@ static int savage_verify_texaddr(drm_savage_private_t * dev_priv, int unit,
#define SAVE_STATE(reg,where) \ #define SAVE_STATE(reg,where) \
if(start <= reg && start+count > reg) \ if(start <= reg && start+count > reg) \
DRM_GET_USER_UNCHECKED(dev_priv->state.where, &regs[reg-start]) dev_priv->state.where = regs[reg - start]
#define SAVE_STATE_MASK(reg,where,mask) do { \ #define SAVE_STATE_MASK(reg,where,mask) do { \
if(start <= reg && start+count > reg) { \ if(start <= reg && start+count > reg) { \
uint32_t tmp; \ uint32_t tmp; \
DRM_GET_USER_UNCHECKED(tmp, &regs[reg-start]); \ tmp = regs[reg - start]; \
dev_priv->state.where = (tmp & (mask)) | \ dev_priv->state.where = (tmp & (mask)) | \
(dev_priv->state.where & ~(mask)); \ (dev_priv->state.where & ~(mask)); \
} \ } \
} while (0) } while (0)
static int savage_verify_state_s3d(drm_savage_private_t * dev_priv, static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
unsigned int start, unsigned int count, unsigned int start, unsigned int count,
const uint32_t __user * regs) const uint32_t *regs)
{ {
if (start < SAVAGE_TEXPALADDR_S3D || if (start < SAVAGE_TEXPALADDR_S3D ||
start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) { start + count - 1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
@ -148,8 +149,7 @@ static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr); SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr);
if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK) if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK)
return savage_verify_texaddr(dev_priv, 0, return savage_verify_texaddr(dev_priv, 0,
dev_priv->state.s3d. dev_priv->state.s3d.texaddr);
texaddr);
} }
return 0; return 0;
@ -157,7 +157,7 @@ static int savage_verify_state_s3d(drm_savage_private_t * dev_priv,
static int savage_verify_state_s4(drm_savage_private_t * dev_priv, static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
unsigned int start, unsigned int count, unsigned int start, unsigned int count,
const uint32_t __user * regs) const uint32_t *regs)
{ {
int ret = 0; int ret = 0;
@ -174,19 +174,18 @@ static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
~SAVAGE_SCISSOR_MASK_S4); ~SAVAGE_SCISSOR_MASK_S4);
/* if any texture regs were changed ... */ /* if any texture regs were changed ... */
if (start <= SAVAGE_TEXDESCR_S4 && start + count > SAVAGE_TEXPALADDR_S4) { if (start <= SAVAGE_TEXDESCR_S4 &&
start + count > SAVAGE_TEXPALADDR_S4) {
/* ... check texture state */ /* ... check texture state */
SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr); SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr);
SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0); SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0);
SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1); SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1);
if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK) if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK)
ret |= ret |= savage_verify_texaddr(dev_priv, 0,
savage_verify_texaddr(dev_priv, 0, dev_priv->state.s4.texaddr0);
dev_priv->state.s4.texaddr0);
if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK) if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK)
ret |= ret |= savage_verify_texaddr(dev_priv, 1,
savage_verify_texaddr(dev_priv, 1, dev_priv->state.s4.texaddr1);
dev_priv->state.s4.texaddr1);
} }
return ret; return ret;
@ -197,7 +196,7 @@ static int savage_verify_state_s4(drm_savage_private_t * dev_priv,
static int savage_dispatch_state(drm_savage_private_t * dev_priv, static int savage_dispatch_state(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t * cmd_header, const drm_savage_cmd_header_t * cmd_header,
const uint32_t __user * regs) const uint32_t *regs)
{ {
unsigned int count = cmd_header->state.count; unsigned int count = cmd_header->state.count;
unsigned int start = cmd_header->state.start; unsigned int start = cmd_header->state.start;
@ -209,9 +208,6 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
if (!count) if (!count)
return 0; return 0;
if (DRM_VERIFYAREA_READ(regs, count * 4))
return DRM_ERR(EFAULT);
if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
ret = savage_verify_state_s3d(dev_priv, start, count, regs); ret = savage_verify_state_s3d(dev_priv, start, count, regs);
if (ret != 0) if (ret != 0)
@ -236,8 +232,8 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
/* scissor regs are emitted in savage_dispatch_draw */ /* scissor regs are emitted in savage_dispatch_draw */
if (start < SAVAGE_DRAWCTRL0_S4) { if (start < SAVAGE_DRAWCTRL0_S4) {
if (start + count > SAVAGE_DRAWCTRL1_S4 + 1) if (start + count > SAVAGE_DRAWCTRL1_S4 + 1)
count2 = count2 = count -
count - (SAVAGE_DRAWCTRL1_S4 + 1 - start); (SAVAGE_DRAWCTRL1_S4 + 1 - start);
if (start + count > SAVAGE_DRAWCTRL0_S4) if (start + count > SAVAGE_DRAWCTRL0_S4)
count = SAVAGE_DRAWCTRL0_S4 - start; count = SAVAGE_DRAWCTRL0_S4 - start;
} else if (start <= SAVAGE_DRAWCTRL1_S4) { } else if (start <= SAVAGE_DRAWCTRL1_S4) {
@ -263,7 +259,7 @@ static int savage_dispatch_state(drm_savage_private_t * dev_priv,
while (count > 0) { while (count > 0) {
unsigned int n = count < 255 ? count : 255; unsigned int n = count < 255 ? count : 255;
DMA_SET_REGISTERS(start, n); DMA_SET_REGISTERS(start, n);
DMA_COPY_FROM_USER(regs, n); DMA_COPY(regs, n);
count -= n; count -= n;
start += n; start += n;
regs += n; regs += n;
@ -421,8 +417,8 @@ static int savage_dispatch_dma_prim(drm_savage_private_t * dev_priv,
static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv, static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t * cmd_header, const drm_savage_cmd_header_t * cmd_header,
const uint32_t __user * vtxbuf, const uint32_t *vtxbuf, unsigned int vb_size,
unsigned int vb_size, unsigned int vb_stride) unsigned int vb_stride)
{ {
unsigned char reorder = 0; unsigned char reorder = 0;
unsigned int prim = cmd_header->prim.prim; unsigned int prim = cmd_header->prim.prim;
@ -507,8 +503,7 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
for (i = start; i < start + count; ++i) { for (i = start; i < start + count; ++i) {
unsigned int j = i + reorder[i % 3]; unsigned int j = i + reorder[i % 3];
DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j], DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
vtx_size);
} }
DMA_COMMIT(); DMA_COMMIT();
@ -517,13 +512,12 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
DMA_DRAW_PRIMITIVE(count, prim, skip); DMA_DRAW_PRIMITIVE(count, prim, skip);
if (vb_stride == vtx_size) { if (vb_stride == vtx_size) {
DMA_COPY_FROM_USER(&vtxbuf[vb_stride * start], DMA_COPY(&vtxbuf[vb_stride * start],
vtx_size * count); vtx_size * count);
} else { } else {
for (i = start; i < start + count; ++i) { for (i = start; i < start + count; ++i) {
DMA_COPY_FROM_USER(&vtxbuf DMA_COPY(&vtxbuf [vb_stride * i],
[vb_stride * i], vtx_size);
vtx_size);
} }
} }
@ -541,7 +535,7 @@ static int savage_dispatch_vb_prim(drm_savage_private_t * dev_priv,
static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv, static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t * cmd_header, const drm_savage_cmd_header_t * cmd_header,
const uint16_t __user * usr_idx, const uint16_t *idx,
const drm_buf_t * dmabuf) const drm_buf_t * dmabuf)
{ {
unsigned char reorder = 0; unsigned char reorder = 0;
@ -628,11 +622,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
while (n != 0) { while (n != 0) {
/* Can emit up to 255 indices (85 triangles) at once. */ /* Can emit up to 255 indices (85 triangles) at once. */
unsigned int count = n > 255 ? 255 : n; unsigned int count = n > 255 ? 255 : n;
/* Is it ok to allocate 510 bytes on the stack in an ioctl? */
uint16_t idx[255];
/* Copy and check indices */ /* check indices */
DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count * 2);
for (i = 0; i < count; ++i) { for (i = 0; i < count; ++i) {
if (idx[i] > dmabuf->total / 32) { if (idx[i] > dmabuf->total / 32) {
DRM_ERROR("idx[%u]=%u out of range (0-%u)\n", DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
@ -652,8 +643,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
for (i = 1; i + 1 < count; i += 2) for (i = 1; i + 1 < count; i += 2)
BCI_WRITE(idx[i + reorder[i % 3]] | BCI_WRITE(idx[i + reorder[i % 3]] |
(idx[i + 1 + reorder[(i + 1) % 3]] << (idx[i + 1 +
16)); reorder[(i + 1) % 3]] << 16));
if (i < count) if (i < count)
BCI_WRITE(idx[i + reorder[i % 3]]); BCI_WRITE(idx[i + reorder[i % 3]]);
} else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) { } else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
@ -674,7 +665,7 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
BCI_WRITE(idx[i]); BCI_WRITE(idx[i]);
} }
usr_idx += count; idx += count;
n -= count; n -= count;
prim |= BCI_CMD_DRAW_CONT; prim |= BCI_CMD_DRAW_CONT;
@ -685,8 +676,8 @@ static int savage_dispatch_dma_idx(drm_savage_private_t * dev_priv,
static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv, static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t * cmd_header, const drm_savage_cmd_header_t * cmd_header,
const uint16_t __user * usr_idx, const uint16_t *idx,
const uint32_t __user * vtxbuf, const uint32_t *vtxbuf,
unsigned int vb_size, unsigned int vb_stride) unsigned int vb_size, unsigned int vb_stride)
{ {
unsigned char reorder = 0; unsigned char reorder = 0;
@ -751,11 +742,8 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
while (n != 0) { while (n != 0) {
/* Can emit up to 255 vertices (85 triangles) at once. */ /* Can emit up to 255 vertices (85 triangles) at once. */
unsigned int count = n > 255 ? 255 : n; unsigned int count = n > 255 ? 255 : n;
/* Is it ok to allocate 510 bytes on the stack in an ioctl? */
uint16_t idx[255]; /* Check indices */
/* Copy and check indices */
DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count * 2);
for (i = 0; i < count; ++i) { for (i = 0; i < count; ++i) {
if (idx[i] > vb_size / (vb_stride * 4)) { if (idx[i] > vb_size / (vb_stride * 4)) {
DRM_ERROR("idx[%u]=%u out of range (0-%u)\n", DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
@ -775,8 +763,7 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
for (i = 0; i < count; ++i) { for (i = 0; i < count; ++i) {
unsigned int j = idx[i + reorder[i % 3]]; unsigned int j = idx[i + reorder[i % 3]];
DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j], DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
vtx_size);
} }
DMA_COMMIT(); DMA_COMMIT();
@ -786,14 +773,13 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
for (i = 0; i < count; ++i) { for (i = 0; i < count; ++i) {
unsigned int j = idx[i]; unsigned int j = idx[i];
DMA_COPY_FROM_USER(&vtxbuf[vb_stride * j], DMA_COPY(&vtxbuf[vb_stride * j], vtx_size);
vtx_size);
} }
DMA_COMMIT(); DMA_COMMIT();
} }
usr_idx += count; idx += count;
n -= count; n -= count;
prim |= BCI_CMD_DRAW_CONT; prim |= BCI_CMD_DRAW_CONT;
@ -804,11 +790,11 @@ static int savage_dispatch_vb_idx(drm_savage_private_t * dev_priv,
static int savage_dispatch_clear(drm_savage_private_t * dev_priv, static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t * cmd_header, const drm_savage_cmd_header_t * cmd_header,
const drm_savage_cmd_header_t __user * data, const drm_savage_cmd_header_t *data,
unsigned int nbox, unsigned int nbox,
const drm_clip_rect_t __user * usr_boxes) const drm_clip_rect_t *boxes)
{ {
unsigned int flags = cmd_header->clear0.flags, mask, value; unsigned int flags = cmd_header->clear0.flags;
unsigned int clear_cmd; unsigned int clear_cmd;
unsigned int i, nbufs; unsigned int i, nbufs;
DMA_LOCALS; DMA_LOCALS;
@ -816,9 +802,6 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
if (nbox == 0) if (nbox == 0)
return 0; return 0;
DRM_GET_USER_UNCHECKED(mask, &data->clear1.mask);
DRM_GET_USER_UNCHECKED(value, &data->clear1.value);
clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP | clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW; BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
BCI_CMD_SET_ROP(clear_cmd, 0xCC); BCI_CMD_SET_ROP(clear_cmd, 0xCC);
@ -828,21 +811,19 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
if (nbufs == 0) if (nbufs == 0)
return 0; return 0;
if (mask != 0xffffffff) { if (data->clear1.mask != 0xffffffff) {
/* set mask */ /* set mask */
BEGIN_DMA(2); BEGIN_DMA(2);
DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1); DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
DMA_WRITE(mask); DMA_WRITE(data->clear1.mask);
DMA_COMMIT(); DMA_COMMIT();
} }
for (i = 0; i < nbox; ++i) { for (i = 0; i < nbox; ++i) {
drm_clip_rect_t box;
unsigned int x, y, w, h; unsigned int x, y, w, h;
unsigned int buf; unsigned int buf;
DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box)); x = boxes[i].x1, y = boxes[i].y1;
x = box.x1, y = box.y1; w = boxes[i].x2 - boxes[i].x1;
w = box.x2 - box.x1; h = boxes[i].y2 - boxes[i].y1;
h = box.y2 - box.y1;
BEGIN_DMA(nbufs * 6); BEGIN_DMA(nbufs * 6);
for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) { for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) {
if (!(flags & buf)) if (!(flags & buf))
@ -862,13 +843,13 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
DMA_WRITE(dev_priv->depth_bd); DMA_WRITE(dev_priv->depth_bd);
break; break;
} }
DMA_WRITE(value); DMA_WRITE(data->clear1.value);
DMA_WRITE(BCI_X_Y(x, y)); DMA_WRITE(BCI_X_Y(x, y));
DMA_WRITE(BCI_W_H(w, h)); DMA_WRITE(BCI_W_H(w, h));
} }
DMA_COMMIT(); DMA_COMMIT();
} }
if (mask != 0xffffffff) { if (data->clear1.mask != 0xffffffff) {
/* reset mask */ /* reset mask */
BEGIN_DMA(2); BEGIN_DMA(2);
DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1); DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
@ -880,8 +861,7 @@ static int savage_dispatch_clear(drm_savage_private_t * dev_priv,
} }
static int savage_dispatch_swap(drm_savage_private_t * dev_priv, static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
unsigned int nbox, unsigned int nbox, const drm_clip_rect_t *boxes)
const drm_clip_rect_t __user * usr_boxes)
{ {
unsigned int swap_cmd; unsigned int swap_cmd;
unsigned int i; unsigned int i;
@ -895,16 +875,14 @@ static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
BCI_CMD_SET_ROP(swap_cmd, 0xCC); BCI_CMD_SET_ROP(swap_cmd, 0xCC);
for (i = 0; i < nbox; ++i) { for (i = 0; i < nbox; ++i) {
drm_clip_rect_t box;
DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
BEGIN_DMA(6); BEGIN_DMA(6);
DMA_WRITE(swap_cmd); DMA_WRITE(swap_cmd);
DMA_WRITE(dev_priv->back_offset); DMA_WRITE(dev_priv->back_offset);
DMA_WRITE(dev_priv->back_bd); DMA_WRITE(dev_priv->back_bd);
DMA_WRITE(BCI_X_Y(box.x1, box.y1)); DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
DMA_WRITE(BCI_X_Y(box.x1, box.y1)); DMA_WRITE(BCI_X_Y(boxes[i].x1, boxes[i].y1));
DMA_WRITE(BCI_W_H(box.x2 - box.x1, box.y2 - box.y1)); DMA_WRITE(BCI_W_H(boxes[i].x2 - boxes[i].x1,
boxes[i].y2 - boxes[i].y1));
DMA_COMMIT(); DMA_COMMIT();
} }
@ -912,68 +890,52 @@ static int savage_dispatch_swap(drm_savage_private_t * dev_priv,
} }
static int savage_dispatch_draw(drm_savage_private_t * dev_priv, static int savage_dispatch_draw(drm_savage_private_t * dev_priv,
const drm_savage_cmd_header_t __user * start, const drm_savage_cmd_header_t *start,
const drm_savage_cmd_header_t __user * end, const drm_savage_cmd_header_t *end,
const drm_buf_t * dmabuf, const drm_buf_t * dmabuf,
const unsigned int __user * usr_vtxbuf, const unsigned int *vtxbuf,
unsigned int vb_size, unsigned int vb_stride, unsigned int vb_size, unsigned int vb_stride,
unsigned int nbox, unsigned int nbox,
const drm_clip_rect_t __user * usr_boxes) const drm_clip_rect_t *boxes)
{ {
unsigned int i, j; unsigned int i, j;
int ret; int ret;
for (i = 0; i < nbox; ++i) { for (i = 0; i < nbox; ++i) {
drm_clip_rect_t box; const drm_savage_cmd_header_t *cmdbuf;
const drm_savage_cmd_header_t __user *usr_cmdbuf; dev_priv->emit_clip_rect(dev_priv, &boxes[i]);
DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
dev_priv->emit_clip_rect(dev_priv, &box);
usr_cmdbuf = start; cmdbuf = start;
while (usr_cmdbuf < end) { while (cmdbuf < end) {
drm_savage_cmd_header_t cmd_header; drm_savage_cmd_header_t cmd_header;
DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf, cmd_header = *cmdbuf;
sizeof(cmd_header)); cmdbuf++;
usr_cmdbuf++;
switch (cmd_header.cmd.cmd) { switch (cmd_header.cmd.cmd) {
case SAVAGE_CMD_DMA_PRIM: case SAVAGE_CMD_DMA_PRIM:
ret = ret = savage_dispatch_dma_prim(
savage_dispatch_dma_prim(dev_priv, dev_priv, &cmd_header, dmabuf);
&cmd_header,
dmabuf);
break; break;
case SAVAGE_CMD_VB_PRIM: case SAVAGE_CMD_VB_PRIM:
ret = ret = savage_dispatch_vb_prim(
savage_dispatch_vb_prim(dev_priv, dev_priv, &cmd_header,
&cmd_header, vtxbuf, vb_size, vb_stride);
(const uint32_t
__user *)
usr_vtxbuf, vb_size,
vb_stride);
break; break;
case SAVAGE_CMD_DMA_IDX: case SAVAGE_CMD_DMA_IDX:
j = (cmd_header.idx.count + 3) / 4; j = (cmd_header.idx.count + 3) / 4;
/* j was check in savage_bci_cmdbuf */ /* j was check in savage_bci_cmdbuf */
ret = ret = savage_dispatch_dma_idx(dev_priv,
savage_dispatch_dma_idx(dev_priv, &cmd_header, (const uint16_t *)cmdbuf,
&cmd_header, dmabuf);
(const uint16_t cmdbuf += j;
__user *)
usr_cmdbuf, dmabuf);
usr_cmdbuf += j;
break; break;
case SAVAGE_CMD_VB_IDX: case SAVAGE_CMD_VB_IDX:
j = (cmd_header.idx.count + 3) / 4; j = (cmd_header.idx.count + 3) / 4;
/* j was check in savage_bci_cmdbuf */ /* j was check in savage_bci_cmdbuf */
ret = ret = savage_dispatch_vb_idx(dev_priv,
savage_dispatch_vb_idx(dev_priv, &cmd_header, (const uint16_t *)cmdbuf,
&cmd_header, (const uint32_t *)vtxbuf, vb_size,
(const uint16_t vb_stride);
__user *)usr_cmdbuf, cmdbuf += j;
(const uint32_t
__user *)usr_vtxbuf,
vb_size, vb_stride);
usr_cmdbuf += j;
break; break;
default: default:
/* What's the best return code? EFAULT? */ /* What's the best return code? EFAULT? */
@ -998,10 +960,10 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
drm_device_dma_t *dma = dev->dma; drm_device_dma_t *dma = dev->dma;
drm_buf_t *dmabuf; drm_buf_t *dmabuf;
drm_savage_cmdbuf_t cmdbuf; drm_savage_cmdbuf_t cmdbuf;
drm_savage_cmd_header_t __user *usr_cmdbuf; drm_savage_cmd_header_t *kcmd_addr = NULL;
drm_savage_cmd_header_t __user *first_draw_cmd; drm_savage_cmd_header_t *first_draw_cmd;
unsigned int __user *usr_vtxbuf; unsigned int *kvb_addr = NULL;
drm_clip_rect_t __user *usr_boxes; drm_clip_rect_t *kbox_addr = NULL;
unsigned int i, j; unsigned int i, j;
int ret = 0; int ret = 0;
@ -1024,15 +986,53 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
dmabuf = NULL; dmabuf = NULL;
} }
usr_cmdbuf = (drm_savage_cmd_header_t __user *) cmdbuf.cmd_addr; /* Copy the user buffers into kernel temporary areas. This hasn't been
usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr; * a performance loss compared to VERIFYAREA_READ/
usr_boxes = (drm_clip_rect_t __user *) cmdbuf.box_addr; * COPY_FROM_USER_UNCHECKED when done in other drivers, and is correct
if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size * 8)) || * for locking on FreeBSD.
(cmdbuf.vb_size && DRM_VERIFYAREA_READ(usr_vtxbuf, cmdbuf.vb_size)) */
|| (cmdbuf.nbox if (cmdbuf.size) {
&& DRM_VERIFYAREA_READ(usr_boxes, kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER);
cmdbuf.nbox * sizeof(drm_clip_rect_t)))) if (kcmd_addr == NULL)
return DRM_ERR(EFAULT); return ENOMEM;
if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr,
cmdbuf.size * 8))
{
drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
return DRM_ERR(EFAULT);
}
cmdbuf.cmd_addr = kcmd_addr;
}
if (cmdbuf.vb_size) {
kvb_addr = drm_alloc(cmdbuf.vb_size, DRM_MEM_DRIVER);
if (kvb_addr == NULL) {
ret = DRM_ERR(ENOMEM);
goto done;
}
if (DRM_COPY_FROM_USER(kvb_addr, cmdbuf.vb_addr,
cmdbuf.vb_size)) {
ret = DRM_ERR(EFAULT);
goto done;
}
cmdbuf.vb_addr = kvb_addr;
}
if (cmdbuf.nbox) {
kbox_addr = drm_alloc(cmdbuf.nbox * sizeof(drm_clip_rect_t),
DRM_MEM_DRIVER);
if (kbox_addr == NULL) {
ret = DRM_ERR(ENOMEM);
goto done;
}
if (DRM_COPY_FROM_USER(kbox_addr, cmdbuf.box_addr,
cmdbuf.nbox * sizeof(drm_clip_rect_t))) {
ret = DRM_ERR(EFAULT);
goto done;
}
cmdbuf.box_addr = kbox_addr;
}
/* Make sure writes to DMA buffers are finished before sending /* Make sure writes to DMA buffers are finished before sending
* DMA commands to the graphics hardware. */ * DMA commands to the graphics hardware. */
@ -1046,9 +1046,8 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
first_draw_cmd = NULL; first_draw_cmd = NULL;
while (i < cmdbuf.size) { while (i < cmdbuf.size) {
drm_savage_cmd_header_t cmd_header; drm_savage_cmd_header_t cmd_header;
DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf, cmd_header = *(drm_savage_cmd_header_t *)cmdbuf.cmd_addr;
sizeof(cmd_header)); cmdbuf.cmd_addr++;
usr_cmdbuf++;
i++; i++;
/* Group drawing commands with same state to minimize /* Group drawing commands with same state to minimize
@ -1068,21 +1067,18 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
case SAVAGE_CMD_DMA_PRIM: case SAVAGE_CMD_DMA_PRIM:
case SAVAGE_CMD_VB_PRIM: case SAVAGE_CMD_VB_PRIM:
if (!first_draw_cmd) if (!first_draw_cmd)
first_draw_cmd = usr_cmdbuf - 1; first_draw_cmd = cmdbuf.cmd_addr - 1;
usr_cmdbuf += j; cmdbuf.cmd_addr += j;
i += j; i += j;
break; break;
default: default:
if (first_draw_cmd) { if (first_draw_cmd) {
ret = ret = savage_dispatch_draw(
savage_dispatch_draw(dev_priv, dev_priv, first_draw_cmd,
first_draw_cmd, cmdbuf.cmd_addr - 1,
usr_cmdbuf - 1, dmabuf, dmabuf, cmdbuf.vb_addr, cmdbuf.vb_size,
usr_vtxbuf, cmdbuf.vb_stride,
cmdbuf.vb_size, cmdbuf.nbox, cmdbuf.box_addr);
cmdbuf.vb_stride,
cmdbuf.nbox,
usr_boxes);
if (ret != 0) if (ret != 0)
return ret; return ret;
first_draw_cmd = NULL; first_draw_cmd = NULL;
@ -1098,12 +1094,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
DRM_ERROR("command SAVAGE_CMD_STATE extends " DRM_ERROR("command SAVAGE_CMD_STATE extends "
"beyond end of command buffer\n"); "beyond end of command buffer\n");
DMA_FLUSH(); DMA_FLUSH();
return DRM_ERR(EINVAL); ret = DRM_ERR(EINVAL);
goto done;
} }
ret = savage_dispatch_state(dev_priv, &cmd_header, ret = savage_dispatch_state(dev_priv, &cmd_header,
(uint32_t __user *) (const uint32_t *)cmdbuf.cmd_addr);
usr_cmdbuf); cmdbuf.cmd_addr += j;
usr_cmdbuf += j;
i += j; i += j;
break; break;
case SAVAGE_CMD_CLEAR: case SAVAGE_CMD_CLEAR:
@ -1111,39 +1107,40 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
DRM_ERROR("command SAVAGE_CMD_CLEAR extends " DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
"beyond end of command buffer\n"); "beyond end of command buffer\n");
DMA_FLUSH(); DMA_FLUSH();
return DRM_ERR(EINVAL); ret = DRM_ERR(EINVAL);
goto done;
} }
ret = savage_dispatch_clear(dev_priv, &cmd_header, ret = savage_dispatch_clear(dev_priv, &cmd_header,
usr_cmdbuf, cmdbuf.cmd_addr,
cmdbuf.nbox, usr_boxes); cmdbuf.nbox, cmdbuf.box_addr);
usr_cmdbuf++; cmdbuf.cmd_addr++;
i++; i++;
break; break;
case SAVAGE_CMD_SWAP: case SAVAGE_CMD_SWAP:
ret = savage_dispatch_swap(dev_priv, ret = savage_dispatch_swap(dev_priv, cmdbuf.nbox,
cmdbuf.nbox, usr_boxes); cmdbuf.box_addr);
break; break;
default: default:
DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd); DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
DMA_FLUSH(); DMA_FLUSH();
return DRM_ERR(EINVAL); ret = DRM_ERR(EINVAL);
goto done;
} }
if (ret != 0) { if (ret != 0) {
DMA_FLUSH(); DMA_FLUSH();
return ret; goto done;
} }
} }
if (first_draw_cmd) { if (first_draw_cmd) {
ret = ret = savage_dispatch_draw (
savage_dispatch_draw(dev_priv, first_draw_cmd, usr_cmdbuf, dev_priv, first_draw_cmd, cmdbuf.cmd_addr, dmabuf,
dmabuf, usr_vtxbuf, cmdbuf.vb_size, cmdbuf.vb_addr, cmdbuf.vb_size, cmdbuf.vb_stride,
cmdbuf.vb_stride, cmdbuf.nbox, cmdbuf.nbox, cmdbuf.box_addr);
usr_boxes);
if (ret != 0) { if (ret != 0) {
DMA_FLUSH(); DMA_FLUSH();
return ret; goto done;
} }
} }
@ -1157,5 +1154,12 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
savage_freelist_put(dev, dmabuf); savage_freelist_put(dev, dmabuf);
} }
return 0; done:
/* If we didn't need to allocate them, these'll be NULL */
drm_free(kcmd_addr, cmdbuf.size * 8, DRM_MEM_DRIVER);
drm_free(kvb_addr, cmdbuf.vb_size, DRM_MEM_DRIVER);
drm_free(kbox_addr, cmdbuf.nbox * sizeof(drm_clip_rect_t),
DRM_MEM_DRIVER);
return ret;
} }