255 lines
5.6 KiB
C
255 lines
5.6 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/* Copyright (c) 2010-2020 NVIDIA Corporation */
|
|
|
|
#include "drm.h"
|
|
#include "submit.h"
|
|
#include "uapi.h"
|
|
|
|
struct tegra_drm_firewall {
|
|
struct tegra_drm_submit_data *submit;
|
|
struct tegra_drm_client *client;
|
|
u32 *data;
|
|
u32 pos;
|
|
u32 end;
|
|
u32 class;
|
|
};
|
|
|
|
static int fw_next(struct tegra_drm_firewall *fw, u32 *word)
|
|
{
|
|
if (fw->pos == fw->end)
|
|
return -EINVAL;
|
|
|
|
*word = fw->data[fw->pos++];
|
|
|
|
return 0;
|
|
}
|
|
|
|
static bool fw_check_addr_valid(struct tegra_drm_firewall *fw, u32 offset)
|
|
{
|
|
u32 i;
|
|
|
|
for (i = 0; i < fw->submit->num_used_mappings; i++) {
|
|
struct tegra_drm_mapping *m = fw->submit->used_mappings[i].mapping;
|
|
|
|
if (offset >= m->iova && offset <= m->iova_end)
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
static int fw_check_reg(struct tegra_drm_firewall *fw, u32 offset)
|
|
{
|
|
bool is_addr;
|
|
u32 word;
|
|
int err;
|
|
|
|
err = fw_next(fw, &word);
|
|
if (err)
|
|
return err;
|
|
|
|
if (!fw->client->ops->is_addr_reg)
|
|
return 0;
|
|
|
|
is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class,
|
|
offset);
|
|
|
|
if (!is_addr)
|
|
return 0;
|
|
|
|
if (!fw_check_addr_valid(fw, word))
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int fw_check_regs_seq(struct tegra_drm_firewall *fw, u32 offset,
|
|
u32 count, bool incr)
|
|
{
|
|
u32 i;
|
|
|
|
for (i = 0; i < count; i++) {
|
|
if (fw_check_reg(fw, offset))
|
|
return -EINVAL;
|
|
|
|
if (incr)
|
|
offset++;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int fw_check_regs_mask(struct tegra_drm_firewall *fw, u32 offset,
|
|
u16 mask)
|
|
{
|
|
unsigned long bmask = mask;
|
|
unsigned int bit;
|
|
|
|
for_each_set_bit(bit, &bmask, 16) {
|
|
if (fw_check_reg(fw, offset+bit))
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset)
|
|
{
|
|
bool is_addr;
|
|
|
|
is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class,
|
|
offset);
|
|
if (is_addr)
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int fw_check_class(struct tegra_drm_firewall *fw, u32 class)
|
|
{
|
|
if (!fw->client->ops->is_valid_class) {
|
|
if (class == fw->client->base.class)
|
|
return 0;
|
|
else
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (!fw->client->ops->is_valid_class(class))
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
enum {
|
|
HOST1X_OPCODE_SETCLASS = 0x00,
|
|
HOST1X_OPCODE_INCR = 0x01,
|
|
HOST1X_OPCODE_NONINCR = 0x02,
|
|
HOST1X_OPCODE_MASK = 0x03,
|
|
HOST1X_OPCODE_IMM = 0x04,
|
|
HOST1X_OPCODE_RESTART = 0x05,
|
|
HOST1X_OPCODE_GATHER = 0x06,
|
|
HOST1X_OPCODE_SETSTRMID = 0x07,
|
|
HOST1X_OPCODE_SETAPPID = 0x08,
|
|
HOST1X_OPCODE_SETPYLD = 0x09,
|
|
HOST1X_OPCODE_INCR_W = 0x0a,
|
|
HOST1X_OPCODE_NONINCR_W = 0x0b,
|
|
HOST1X_OPCODE_GATHER_W = 0x0c,
|
|
HOST1X_OPCODE_RESTART_W = 0x0d,
|
|
HOST1X_OPCODE_EXTEND = 0x0e,
|
|
};
|
|
|
|
int tegra_drm_fw_validate(struct tegra_drm_client *client, u32 *data, u32 start,
|
|
u32 words, struct tegra_drm_submit_data *submit,
|
|
u32 *job_class)
|
|
{
|
|
struct tegra_drm_firewall fw = {
|
|
.submit = submit,
|
|
.client = client,
|
|
.data = data,
|
|
.pos = start,
|
|
.end = start+words,
|
|
.class = *job_class,
|
|
};
|
|
bool payload_valid = false;
|
|
u32 payload;
|
|
int err;
|
|
|
|
while (fw.pos != fw.end) {
|
|
u32 word, opcode, offset, count, mask, class;
|
|
|
|
err = fw_next(&fw, &word);
|
|
if (err)
|
|
return err;
|
|
|
|
opcode = (word & 0xf0000000) >> 28;
|
|
|
|
switch (opcode) {
|
|
case HOST1X_OPCODE_SETCLASS:
|
|
offset = word >> 16 & 0xfff;
|
|
mask = word & 0x3f;
|
|
class = (word >> 6) & 0x3ff;
|
|
err = fw_check_class(&fw, class);
|
|
fw.class = class;
|
|
*job_class = class;
|
|
if (!err)
|
|
err = fw_check_regs_mask(&fw, offset, mask);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal SETCLASS(offset=0x%x, mask=0x%x, class=0x%x) at word %u",
|
|
offset, mask, class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_INCR:
|
|
offset = (word >> 16) & 0xfff;
|
|
count = word & 0xffff;
|
|
err = fw_check_regs_seq(&fw, offset, count, true);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal INCR(offset=0x%x, count=%u) in class 0x%x at word %u",
|
|
offset, count, fw.class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_NONINCR:
|
|
offset = (word >> 16) & 0xfff;
|
|
count = word & 0xffff;
|
|
err = fw_check_regs_seq(&fw, offset, count, false);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal NONINCR(offset=0x%x, count=%u) in class 0x%x at word %u",
|
|
offset, count, fw.class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_MASK:
|
|
offset = (word >> 16) & 0xfff;
|
|
mask = word & 0xffff;
|
|
err = fw_check_regs_mask(&fw, offset, mask);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal MASK(offset=0x%x, mask=0x%x) in class 0x%x at word %u",
|
|
offset, mask, fw.class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_IMM:
|
|
/* IMM cannot reasonably be used to write a pointer */
|
|
offset = (word >> 16) & 0xfff;
|
|
err = fw_check_regs_imm(&fw, offset);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal IMM(offset=0x%x) in class 0x%x at word %u",
|
|
offset, fw.class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_SETPYLD:
|
|
payload = word & 0xffff;
|
|
payload_valid = true;
|
|
break;
|
|
case HOST1X_OPCODE_INCR_W:
|
|
if (!payload_valid)
|
|
return -EINVAL;
|
|
|
|
offset = word & 0x3fffff;
|
|
err = fw_check_regs_seq(&fw, offset, payload, true);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal INCR_W(offset=0x%x) in class 0x%x at word %u",
|
|
offset, fw.class, fw.pos-1);
|
|
break;
|
|
case HOST1X_OPCODE_NONINCR_W:
|
|
if (!payload_valid)
|
|
return -EINVAL;
|
|
|
|
offset = word & 0x3fffff;
|
|
err = fw_check_regs_seq(&fw, offset, payload, false);
|
|
if (err)
|
|
dev_warn(client->base.dev,
|
|
"illegal NONINCR(offset=0x%x) in class 0x%x at word %u",
|
|
offset, fw.class, fw.pos-1);
|
|
break;
|
|
default:
|
|
dev_warn(client->base.dev, "illegal opcode at word %u",
|
|
fw.pos-1);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (err)
|
|
return err;
|
|
}
|
|
|
|
return 0;
|
|
}
|