svn commit: r342182 - in head/sys: dev/drm2/radeon modules/drm2/radeonkms

Mark Johnston markj at FreeBSD.org
Mon Dec 17 21:48:22 UTC 2018


Author: markj
Date: Mon Dec 17 21:48:20 2018
New Revision: 342182
URL: https://svnweb.freebsd.org/changeset/base/342182

Log:
  Remove UMS support code from radeonkms.
  
  The code is unreachable since the entries of radeon_ioctls[] are not
  associated with any device: we provide only the KMS entry points.
  Moreover, r600_cp_dispatch_texture() contains an integer overflow bug
  that can be triggered from userspace.[1]
  
  Reported by:	Anonymous of the Shellphish Grill Team[1]
  Reviewed by:	dumbbell
  MFC after:	2 weeks
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D18516

Deleted:
  head/sys/dev/drm2/radeon/r300_cmdbuf.c
  head/sys/dev/drm2/radeon/r600_blit.c
  head/sys/dev/drm2/radeon/r600_cp.c
  head/sys/dev/drm2/radeon/radeon_cp.c
  head/sys/dev/drm2/radeon/radeon_ioc32.c
  head/sys/dev/drm2/radeon/radeon_state.c
Modified:
  head/sys/dev/drm2/radeon/r600_blit_kms.c
  head/sys/dev/drm2/radeon/r600_cs.c
  head/sys/dev/drm2/radeon/radeon_irq.c
  head/sys/modules/drm2/radeonkms/Makefile

Modified: head/sys/dev/drm2/radeon/r600_blit_kms.c
==============================================================================
--- head/sys/dev/drm2/radeon/r600_blit_kms.c	Mon Dec 17 21:46:42 2018	(r342181)
+++ head/sys/dev/drm2/radeon/r600_blit_kms.c	Mon Dec 17 21:48:20 2018	(r342182)
@@ -35,6 +35,39 @@ __FBSDID("$FreeBSD$");
 #include "r600_blit_shaders.h"
 #include "radeon_blit_common.h"
 
+/* 23 bits of float fractional data */
+#define I2F_FRAC_BITS  23
+#define I2F_MASK ((1 << I2F_FRAC_BITS) - 1)
+
+/*
+ * Converts unsigned integer into 32-bit IEEE floating point representation.
+ * Will be exact from 0 to 2^24.  Above that, we round towards zero
+ * as the fractional bits will not fit in a float.  (It would be better to
+ * round towards even as the fpu does, but that is slower.)
+ *
+ * Moved from r600_blit.c after that file was removed.
+ */
+__pure uint32_t int2float(uint32_t x)
+{
+	uint32_t msb, exponent, fraction;
+
+	/* Zero is special */
+	if (!x) return 0;
+
+	/* Get location of the most significant bit */
+	msb = fls(x);
+
+	/*
+	 * Use a rotate instead of a shift because that works both leftwards
+	 * and rightwards due to the mod(32) behaviour.  This means we don't
+	 * need to check to see if we are above 2^24 or not.
+	 */
+	fraction = ror32(x, (msb - I2F_FRAC_BITS) & 0x1f) & I2F_MASK;
+	exponent = (127 + msb) << I2F_FRAC_BITS;
+
+	return fraction + exponent;
+}
+
 /* emits 21 on rv770+, 23 on r600 */
 static void
 set_render_target(struct radeon_device *rdev, int format,

Modified: head/sys/dev/drm2/radeon/r600_cs.c
==============================================================================
--- head/sys/dev/drm2/radeon/r600_cs.c	Mon Dec 17 21:46:42 2018	(r342181)
+++ head/sys/dev/drm2/radeon/r600_cs.c	Mon Dec 17 21:48:20 2018	(r342182)
@@ -39,8 +39,6 @@ __FBSDID("$FreeBSD$");
 
 static int r600_cs_packet_next_reloc_mm(struct radeon_cs_parser *p,
 					struct radeon_cs_reloc **cs_reloc);
-static int r600_cs_packet_next_reloc_nomm(struct radeon_cs_parser *p,
-					struct radeon_cs_reloc **cs_reloc);
 typedef int (*next_reloc_t)(struct radeon_cs_parser*, struct radeon_cs_reloc**);
 static next_reloc_t r600_cs_packet_next_reloc = &r600_cs_packet_next_reloc_mm;
 #ifdef FREEBSD_WIP /* FreeBSD: to please GCC 4.2. */
@@ -885,53 +883,6 @@ static int r600_cs_packet_next_reloc_mm(struct radeon_
 }
 
 /**
- * r600_cs_packet_next_reloc_nomm() - parse next packet which should be reloc packet3
- * @parser:		parser structure holding parsing context.
- * @data:		pointer to relocation data
- * @offset_start:	starting offset
- * @offset_mask:	offset mask (to align start offset on)
- * @reloc:		reloc informations
- *
- * Check next packet is relocation packet3, do bo validation and compute
- * GPU offset using the provided start.
- **/
-static int r600_cs_packet_next_reloc_nomm(struct radeon_cs_parser *p,
-					struct radeon_cs_reloc **cs_reloc)
-{
-	struct radeon_cs_chunk *relocs_chunk;
-	struct radeon_cs_packet p3reloc;
-	unsigned idx;
-	int r;
-
-	if (p->chunk_relocs_idx == -1) {
-		DRM_ERROR("No relocation chunk !\n");
-		return -EINVAL;
-	}
-	*cs_reloc = NULL;
-	relocs_chunk = &p->chunks[p->chunk_relocs_idx];
-	r = r600_cs_packet_parse(p, &p3reloc, p->idx);
-	if (r) {
-		return r;
-	}
-	p->idx += p3reloc.count + 2;
-	if (p3reloc.type != PACKET_TYPE3 || p3reloc.opcode != PACKET3_NOP) {
-		DRM_ERROR("No packet3 for relocation for packet at %d.\n",
-			  p3reloc.idx);
-		return -EINVAL;
-	}
-	idx = radeon_get_ib_value(p, p3reloc.idx + 1);
-	if (idx >= relocs_chunk->length_dw) {
-		DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
-			  idx, relocs_chunk->length_dw);
-		return -EINVAL;
-	}
-	*cs_reloc = p->relocs;
-	(*cs_reloc)->lobj.gpu_offset = (u64)relocs_chunk->kdata[idx + 3] << 32;
-	(*cs_reloc)->lobj.gpu_offset |= relocs_chunk->kdata[idx + 0];
-	return 0;
-}
-
-/**
  * r600_cs_packet_next_is_pkt3_nop() - test if next packet is packet3 nop for reloc
  * @parser:		parser structure holding parsing context.
  *
@@ -2456,105 +2407,6 @@ int r600_cs_parse(struct radeon_cs_parser *p)
 	free(p->track, DRM_MEM_DRIVER);
 	p->track = NULL;
 	return 0;
-}
-
-static int r600_cs_parser_relocs_legacy(struct radeon_cs_parser *p)
-{
-	if (p->chunk_relocs_idx == -1) {
-		return 0;
-	}
-	p->relocs = malloc(sizeof(struct radeon_cs_reloc),
-	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
-	if (p->relocs == NULL) {
-		return -ENOMEM;
-	}
-	return 0;
-}
-
-/**
- * cs_parser_fini() - clean parser states
- * @parser:	parser structure holding parsing context.
- * @error:	error number
- *
- * If error is set than unvalidate buffer, otherwise just free memory
- * used by parsing context.
- **/
-static void r600_cs_parser_fini(struct radeon_cs_parser *parser, int error)
-{
-	unsigned i;
-
-	free(parser->relocs, DRM_MEM_DRIVER);
-	for (i = 0; i < parser->nchunks; i++) {
-		free(parser->chunks[i].kdata, DRM_MEM_DRIVER);
-		if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) {
-			free(parser->chunks[i].kpage[0], DRM_MEM_DRIVER);
-			free(parser->chunks[i].kpage[1], DRM_MEM_DRIVER);
-		}
-	}
-	free(parser->chunks, DRM_MEM_DRIVER);
-	free(parser->chunks_array, DRM_MEM_DRIVER);
-	free(parser->track, DRM_MEM_DRIVER);
-}
-
-int r600_cs_legacy(struct drm_device *dev, void *data, struct drm_file *filp,
-			unsigned family, u32 *ib, int *l)
-{
-	struct radeon_cs_parser parser;
-	struct radeon_cs_chunk *ib_chunk;
-	struct r600_cs_track *track;
-	int r;
-
-	/* initialize tracker */
-	track = malloc(sizeof(*track), DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
-	if (track == NULL)
-		return -ENOMEM;
-	r600_cs_track_init(track);
-	r600_cs_legacy_get_tiling_conf(dev, &track->npipes, &track->nbanks, &track->group_size);
-	/* initialize parser */
-	memset(&parser, 0, sizeof(struct radeon_cs_parser));
-	parser.filp = filp;
-	parser.dev = dev->dev;
-	parser.rdev = NULL;
-	parser.family = family;
-	parser.track = track;
-	parser.ib.ptr = ib;
-	r = radeon_cs_parser_init(&parser, data);
-	if (r) {
-		DRM_ERROR("Failed to initialize parser !\n");
-		r600_cs_parser_fini(&parser, r);
-		return r;
-	}
-	r = r600_cs_parser_relocs_legacy(&parser);
-	if (r) {
-		DRM_ERROR("Failed to parse relocation !\n");
-		r600_cs_parser_fini(&parser, r);
-		return r;
-	}
-	/* Copy the packet into the IB, the parser will read from the
-	 * input memory (cached) and write to the IB (which can be
-	 * uncached). */
-	ib_chunk = &parser.chunks[parser.chunk_ib_idx];
-	parser.ib.length_dw = ib_chunk->length_dw;
-	*l = parser.ib.length_dw;
-	r = r600_cs_parse(&parser);
-	if (r) {
-		DRM_ERROR("Invalid command stream !\n");
-		r600_cs_parser_fini(&parser, r);
-		return r;
-	}
-	r = radeon_cs_finish_pages(&parser);
-	if (r) {
-		DRM_ERROR("Invalid command stream !\n");
-		r600_cs_parser_fini(&parser, r);
-		return r;
-	}
-	r600_cs_parser_fini(&parser, r);
-	return r;
-}
-
-void r600_cs_legacy_init(void)
-{
-	r600_cs_packet_next_reloc = &r600_cs_packet_next_reloc_nomm;
 }
 
 /*

Modified: head/sys/dev/drm2/radeon/radeon_irq.c
==============================================================================
--- head/sys/dev/drm2/radeon/radeon_irq.c	Mon Dec 17 21:46:42 2018	(r342181)
+++ head/sys/dev/drm2/radeon/radeon_irq.c	Mon Dec 17 21:48:20 2018	(r342182)
@@ -221,41 +221,6 @@ irqreturn_t radeon_driver_irq_handler(DRM_IRQ_ARGS)
 	return IRQ_HANDLED;
 }
 
-static int radeon_emit_irq(struct drm_device * dev)
-{
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-	unsigned int ret;
-	RING_LOCALS;
-
-	atomic_inc(&dev_priv->swi_emitted);
-	ret = atomic_read(&dev_priv->swi_emitted);
-
-	BEGIN_RING(4);
-	OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
-	OUT_RING_REG(RADEON_GEN_INT_STATUS, RADEON_SW_INT_FIRE);
-	ADVANCE_RING();
-	COMMIT_RING();
-
-	return ret;
-}
-
-static int radeon_wait_irq(struct drm_device * dev, int swi_nr)
-{
-	drm_radeon_private_t *dev_priv =
-	    (drm_radeon_private_t *) dev->dev_private;
-	int ret = 0;
-
-	if (RADEON_READ(RADEON_LAST_SWI_REG) >= swi_nr)
-		return 0;
-
-	dev_priv->stats.boxes |= RADEON_BOX_WAIT_IDLE;
-
-	DRM_WAIT_ON(ret, dev_priv->swi_queue, 3 * DRM_HZ,
-		    RADEON_READ(RADEON_LAST_SWI_REG) >= swi_nr);
-
-	return ret;
-}
-
 u32 radeon_get_vblank_counter(struct drm_device *dev, int crtc)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
@@ -281,52 +246,6 @@ u32 radeon_get_vblank_counter(struct drm_device *dev, 
 		else
 			return RADEON_READ(RADEON_CRTC2_CRNT_FRAME);
 	}
-}
-
-/* Needs the lock as it touches the ring.
- */
-int radeon_irq_emit(struct drm_device *dev, void *data, struct drm_file *file_priv)
-{
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-	drm_radeon_irq_emit_t *emit = data;
-	int result;
-
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
-
-	if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600)
-		return -EINVAL;
-
-	LOCK_TEST_WITH_RETURN(dev, file_priv);
-
-	result = radeon_emit_irq(dev);
-
-	if (DRM_COPY_TO_USER(emit->irq_seq, &result, sizeof(int))) {
-		DRM_ERROR("copy_to_user\n");
-		return -EFAULT;
-	}
-
-	return 0;
-}
-
-/* Doesn't need the hardware lock.
- */
-int radeon_irq_wait(struct drm_device *dev, void *data, struct drm_file *file_priv)
-{
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-	drm_radeon_irq_wait_t *irqwait = data;
-
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
-
-	if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600)
-		return -EINVAL;
-
-	return radeon_wait_irq(dev, irqwait->irq_seq);
 }
 
 /* drm_dma.h hooks

Modified: head/sys/modules/drm2/radeonkms/Makefile
==============================================================================
--- head/sys/modules/drm2/radeonkms/Makefile	Mon Dec 17 21:46:42 2018	(r342181)
+++ head/sys/modules/drm2/radeonkms/Makefile	Mon Dec 17 21:48:20 2018	(r342182)
@@ -25,7 +25,6 @@ SRCS	+=								\
 	radeon_clocks.c							\
 	radeon_combios.c						\
 	radeon_connectors.c						\
-	radeon_cp.c							\
 	radeon_cs.c							\
 	radeon_cursor.c							\
 	radeon_device.c							\
@@ -50,7 +49,6 @@ SRCS	+=								\
 	radeon_ring.c							\
 	radeon_sa.c							\
 	radeon_semaphore.c						\
-	radeon_state.c							\
 	radeon_test.c							\
 	radeon_ttm.c							\
 	atom.c								\
@@ -61,7 +59,6 @@ SRCS	+=								\
 	r100.c								\
 	r200.c								\
 	r300.c								\
-	r300_cmdbuf.c							\
 	r420.c								\
 	rs400.c								\
 	rs600.c								\
@@ -70,10 +67,8 @@ SRCS	+=								\
 	r520.c								\
 	r600.c								\
 	r600_audio.c							\
-	r600_blit.c							\
 	r600_blit_kms.c							\
 	r600_blit_shaders.c						\
-	r600_cp.c							\
 	r600_cs.c							\
 	r600_hdmi.c							\
 	rv770.c								\
@@ -92,10 +87,6 @@ radeon_acpi=		radeon_acpi.c
 #radeon_atpx_handler=	radeon_atpx_handler.c
 .endif
 
-.if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_ARCH} == "powerpc64"
-radeon_ioc32=		radeon_ioc32.c
-.endif
-
 #radeon_prime.c
 #--radeon_trace_points.c
 
@@ -115,7 +106,5 @@ SRCS	+=								\
 
 CFLAGS+=			-I${SRCTOP}/sys/dev/drm2/radeon
 
-CWARNFLAGS.radeon_cp.c=		-Wno-unused-value
-CWARNFLAGS.r600_cp.c=		-Wno-unused-value
 CWARNFLAGS+=			${CWARNFLAGS.${.IMPSRC:T}}
 CWARNFLAGS+=	${NO_WUNUSED_BUT_SET_VARIABLE}


More information about the svn-src-head mailing list