Date: Mon, 17 Dec 2018 21:48:20 +0000 (UTC) From: Mark Johnston <markj@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r342182 - in head/sys: dev/drm2/radeon modules/drm2/radeonkms Message-ID: <201812172148.wBHLmKIp027867@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: markj Date: Mon Dec 17 21:48:20 2018 New Revision: 342182 URL: https://svnweb.freebsd.org/changeset/base/342182 Log: Remove UMS support code from radeonkms. The code is unreachable since the entries of radeon_ioctls[] are not associated with any device: we provide only the KMS entry points. Moreover, r600_cp_dispatch_texture() contains an integer overflow bug that can be triggered from userspace.[1] Reported by: Anonymous of the Shellphish Grill Team[1] Reviewed by: dumbbell MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D18516 Deleted: head/sys/dev/drm2/radeon/r300_cmdbuf.c head/sys/dev/drm2/radeon/r600_blit.c head/sys/dev/drm2/radeon/r600_cp.c head/sys/dev/drm2/radeon/radeon_cp.c head/sys/dev/drm2/radeon/radeon_ioc32.c head/sys/dev/drm2/radeon/radeon_state.c Modified: head/sys/dev/drm2/radeon/r600_blit_kms.c head/sys/dev/drm2/radeon/r600_cs.c head/sys/dev/drm2/radeon/radeon_irq.c head/sys/modules/drm2/radeonkms/Makefile Modified: head/sys/dev/drm2/radeon/r600_blit_kms.c ============================================================================== --- head/sys/dev/drm2/radeon/r600_blit_kms.c Mon Dec 17 21:46:42 2018 (r342181) +++ head/sys/dev/drm2/radeon/r600_blit_kms.c Mon Dec 17 21:48:20 2018 (r342182) @@ -35,6 +35,39 @@ __FBSDID("$FreeBSD$"); #include "r600_blit_shaders.h" #include "radeon_blit_common.h" +/* 23 bits of float fractional data */ +#define I2F_FRAC_BITS 23 +#define I2F_MASK ((1 << I2F_FRAC_BITS) - 1) + +/* + * Converts unsigned integer into 32-bit IEEE floating point representation. + * Will be exact from 0 to 2^24. Above that, we round towards zero + * as the fractional bits will not fit in a float. (It would be better to + * round towards even as the fpu does, but that is slower.) + * + * Moved from r600_blit.c after that file was removed. + */ +__pure uint32_t int2float(uint32_t x) +{ + uint32_t msb, exponent, fraction; + + /* Zero is special */ + if (!x) return 0; + + /* Get location of the most significant bit */ + msb = fls(x); + + /* + * Use a rotate instead of a shift because that works both leftwards + * and rightwards due to the mod(32) behaviour. This means we don't + * need to check to see if we are above 2^24 or not. + */ + fraction = ror32(x, (msb - I2F_FRAC_BITS) & 0x1f) & I2F_MASK; + exponent = (127 + msb) << I2F_FRAC_BITS; + + return fraction + exponent; +} + /* emits 21 on rv770+, 23 on r600 */ static void set_render_target(struct radeon_device *rdev, int format, Modified: head/sys/dev/drm2/radeon/r600_cs.c ============================================================================== --- head/sys/dev/drm2/radeon/r600_cs.c Mon Dec 17 21:46:42 2018 (r342181) +++ head/sys/dev/drm2/radeon/r600_cs.c Mon Dec 17 21:48:20 2018 (r342182) @@ -39,8 +39,6 @@ __FBSDID("$FreeBSD$"); static int r600_cs_packet_next_reloc_mm(struct radeon_cs_parser *p, struct radeon_cs_reloc **cs_reloc); -static int r600_cs_packet_next_reloc_nomm(struct radeon_cs_parser *p, - struct radeon_cs_reloc **cs_reloc); typedef int (*next_reloc_t)(struct radeon_cs_parser*, struct radeon_cs_reloc**); static next_reloc_t r600_cs_packet_next_reloc = &r600_cs_packet_next_reloc_mm; #ifdef FREEBSD_WIP /* FreeBSD: to please GCC 4.2. */ @@ -885,53 +883,6 @@ static int r600_cs_packet_next_reloc_mm(struct radeon_ } /** - * r600_cs_packet_next_reloc_nomm() - parse next packet which should be reloc packet3 - * @parser: parser structure holding parsing context. - * @data: pointer to relocation data - * @offset_start: starting offset - * @offset_mask: offset mask (to align start offset on) - * @reloc: reloc informations - * - * Check next packet is relocation packet3, do bo validation and compute - * GPU offset using the provided start. - **/ -static int r600_cs_packet_next_reloc_nomm(struct radeon_cs_parser *p, - struct radeon_cs_reloc **cs_reloc) -{ - struct radeon_cs_chunk *relocs_chunk; - struct radeon_cs_packet p3reloc; - unsigned idx; - int r; - - if (p->chunk_relocs_idx == -1) { - DRM_ERROR("No relocation chunk !\n"); - return -EINVAL; - } - *cs_reloc = NULL; - relocs_chunk = &p->chunks[p->chunk_relocs_idx]; - r = r600_cs_packet_parse(p, &p3reloc, p->idx); - if (r) { - return r; - } - p->idx += p3reloc.count + 2; - if (p3reloc.type != PACKET_TYPE3 || p3reloc.opcode != PACKET3_NOP) { - DRM_ERROR("No packet3 for relocation for packet at %d.\n", - p3reloc.idx); - return -EINVAL; - } - idx = radeon_get_ib_value(p, p3reloc.idx + 1); - if (idx >= relocs_chunk->length_dw) { - DRM_ERROR("Relocs at %d after relocations chunk end %d !\n", - idx, relocs_chunk->length_dw); - return -EINVAL; - } - *cs_reloc = p->relocs; - (*cs_reloc)->lobj.gpu_offset = (u64)relocs_chunk->kdata[idx + 3] << 32; - (*cs_reloc)->lobj.gpu_offset |= relocs_chunk->kdata[idx + 0]; - return 0; -} - -/** * r600_cs_packet_next_is_pkt3_nop() - test if next packet is packet3 nop for reloc * @parser: parser structure holding parsing context. * @@ -2456,105 +2407,6 @@ int r600_cs_parse(struct radeon_cs_parser *p) free(p->track, DRM_MEM_DRIVER); p->track = NULL; return 0; -} - -static int r600_cs_parser_relocs_legacy(struct radeon_cs_parser *p) -{ - if (p->chunk_relocs_idx == -1) { - return 0; - } - p->relocs = malloc(sizeof(struct radeon_cs_reloc), - DRM_MEM_DRIVER, M_NOWAIT | M_ZERO); - if (p->relocs == NULL) { - return -ENOMEM; - } - return 0; -} - -/** - * cs_parser_fini() - clean parser states - * @parser: parser structure holding parsing context. - * @error: error number - * - * If error is set than unvalidate buffer, otherwise just free memory - * used by parsing context. - **/ -static void r600_cs_parser_fini(struct radeon_cs_parser *parser, int error) -{ - unsigned i; - - free(parser->relocs, DRM_MEM_DRIVER); - for (i = 0; i < parser->nchunks; i++) { - free(parser->chunks[i].kdata, DRM_MEM_DRIVER); - if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) { - free(parser->chunks[i].kpage[0], DRM_MEM_DRIVER); - free(parser->chunks[i].kpage[1], DRM_MEM_DRIVER); - } - } - free(parser->chunks, DRM_MEM_DRIVER); - free(parser->chunks_array, DRM_MEM_DRIVER); - free(parser->track, DRM_MEM_DRIVER); -} - -int r600_cs_legacy(struct drm_device *dev, void *data, struct drm_file *filp, - unsigned family, u32 *ib, int *l) -{ - struct radeon_cs_parser parser; - struct radeon_cs_chunk *ib_chunk; - struct r600_cs_track *track; - int r; - - /* initialize tracker */ - track = malloc(sizeof(*track), DRM_MEM_DRIVER, M_NOWAIT | M_ZERO); - if (track == NULL) - return -ENOMEM; - r600_cs_track_init(track); - r600_cs_legacy_get_tiling_conf(dev, &track->npipes, &track->nbanks, &track->group_size); - /* initialize parser */ - memset(&parser, 0, sizeof(struct radeon_cs_parser)); - parser.filp = filp; - parser.dev = dev->dev; - parser.rdev = NULL; - parser.family = family; - parser.track = track; - parser.ib.ptr = ib; - r = radeon_cs_parser_init(&parser, data); - if (r) { - DRM_ERROR("Failed to initialize parser !\n"); - r600_cs_parser_fini(&parser, r); - return r; - } - r = r600_cs_parser_relocs_legacy(&parser); - if (r) { - DRM_ERROR("Failed to parse relocation !\n"); - r600_cs_parser_fini(&parser, r); - return r; - } - /* Copy the packet into the IB, the parser will read from the - * input memory (cached) and write to the IB (which can be - * uncached). */ - ib_chunk = &parser.chunks[parser.chunk_ib_idx]; - parser.ib.length_dw = ib_chunk->length_dw; - *l = parser.ib.length_dw; - r = r600_cs_parse(&parser); - if (r) { - DRM_ERROR("Invalid command stream !\n"); - r600_cs_parser_fini(&parser, r); - return r; - } - r = radeon_cs_finish_pages(&parser); - if (r) { - DRM_ERROR("Invalid command stream !\n"); - r600_cs_parser_fini(&parser, r); - return r; - } - r600_cs_parser_fini(&parser, r); - return r; -} - -void r600_cs_legacy_init(void) -{ - r600_cs_packet_next_reloc = &r600_cs_packet_next_reloc_nomm; } /* Modified: head/sys/dev/drm2/radeon/radeon_irq.c ============================================================================== --- head/sys/dev/drm2/radeon/radeon_irq.c Mon Dec 17 21:46:42 2018 (r342181) +++ head/sys/dev/drm2/radeon/radeon_irq.c Mon Dec 17 21:48:20 2018 (r342182) @@ -221,41 +221,6 @@ irqreturn_t radeon_driver_irq_handler(DRM_IRQ_ARGS) return IRQ_HANDLED; } -static int radeon_emit_irq(struct drm_device * dev) -{ - drm_radeon_private_t *dev_priv = dev->dev_private; - unsigned int ret; - RING_LOCALS; - - atomic_inc(&dev_priv->swi_emitted); - ret = atomic_read(&dev_priv->swi_emitted); - - BEGIN_RING(4); - OUT_RING_REG(RADEON_LAST_SWI_REG, ret); - OUT_RING_REG(RADEON_GEN_INT_STATUS, RADEON_SW_INT_FIRE); - ADVANCE_RING(); - COMMIT_RING(); - - return ret; -} - -static int radeon_wait_irq(struct drm_device * dev, int swi_nr) -{ - drm_radeon_private_t *dev_priv = - (drm_radeon_private_t *) dev->dev_private; - int ret = 0; - - if (RADEON_READ(RADEON_LAST_SWI_REG) >= swi_nr) - return 0; - - dev_priv->stats.boxes |= RADEON_BOX_WAIT_IDLE; - - DRM_WAIT_ON(ret, dev_priv->swi_queue, 3 * DRM_HZ, - RADEON_READ(RADEON_LAST_SWI_REG) >= swi_nr); - - return ret; -} - u32 radeon_get_vblank_counter(struct drm_device *dev, int crtc) { drm_radeon_private_t *dev_priv = dev->dev_private; @@ -281,52 +246,6 @@ u32 radeon_get_vblank_counter(struct drm_device *dev, else return RADEON_READ(RADEON_CRTC2_CRNT_FRAME); } -} - -/* Needs the lock as it touches the ring. - */ -int radeon_irq_emit(struct drm_device *dev, void *data, struct drm_file *file_priv) -{ - drm_radeon_private_t *dev_priv = dev->dev_private; - drm_radeon_irq_emit_t *emit = data; - int result; - - if (!dev_priv) { - DRM_ERROR("called with no initialization\n"); - return -EINVAL; - } - - if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600) - return -EINVAL; - - LOCK_TEST_WITH_RETURN(dev, file_priv); - - result = radeon_emit_irq(dev); - - if (DRM_COPY_TO_USER(emit->irq_seq, &result, sizeof(int))) { - DRM_ERROR("copy_to_user\n"); - return -EFAULT; - } - - return 0; -} - -/* Doesn't need the hardware lock. - */ -int radeon_irq_wait(struct drm_device *dev, void *data, struct drm_file *file_priv) -{ - drm_radeon_private_t *dev_priv = dev->dev_private; - drm_radeon_irq_wait_t *irqwait = data; - - if (!dev_priv) { - DRM_ERROR("called with no initialization\n"); - return -EINVAL; - } - - if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600) - return -EINVAL; - - return radeon_wait_irq(dev, irqwait->irq_seq); } /* drm_dma.h hooks Modified: head/sys/modules/drm2/radeonkms/Makefile ============================================================================== --- head/sys/modules/drm2/radeonkms/Makefile Mon Dec 17 21:46:42 2018 (r342181) +++ head/sys/modules/drm2/radeonkms/Makefile Mon Dec 17 21:48:20 2018 (r342182) @@ -25,7 +25,6 @@ SRCS += \ radeon_clocks.c \ radeon_combios.c \ radeon_connectors.c \ - radeon_cp.c \ radeon_cs.c \ radeon_cursor.c \ radeon_device.c \ @@ -50,7 +49,6 @@ SRCS += \ radeon_ring.c \ radeon_sa.c \ radeon_semaphore.c \ - radeon_state.c \ radeon_test.c \ radeon_ttm.c \ atom.c \ @@ -61,7 +59,6 @@ SRCS += \ r100.c \ r200.c \ r300.c \ - r300_cmdbuf.c \ r420.c \ rs400.c \ rs600.c \ @@ -70,10 +67,8 @@ SRCS += \ r520.c \ r600.c \ r600_audio.c \ - r600_blit.c \ r600_blit_kms.c \ r600_blit_shaders.c \ - r600_cp.c \ r600_cs.c \ r600_hdmi.c \ rv770.c \ @@ -92,10 +87,6 @@ radeon_acpi= radeon_acpi.c #radeon_atpx_handler= radeon_atpx_handler.c .endif -.if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_ARCH} == "powerpc64" -radeon_ioc32= radeon_ioc32.c -.endif - #radeon_prime.c #--radeon_trace_points.c @@ -115,7 +106,5 @@ SRCS += \ CFLAGS+= -I${SRCTOP}/sys/dev/drm2/radeon -CWARNFLAGS.radeon_cp.c= -Wno-unused-value -CWARNFLAGS.r600_cp.c= -Wno-unused-value CWARNFLAGS+= ${CWARNFLAGS.${.IMPSRC:T}} CWARNFLAGS+= ${NO_WUNUSED_BUT_SET_VARIABLE}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201812172148.wBHLmKIp027867>