vc4_validate.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939
  1. /*
  2. * Copyright © 2014 Broadcom
  3. *
  4. * Permission is hereby granted, free of charge, to any person obtaining a
  5. * copy of this software and associated documentation files (the "Software"),
  6. * to deal in the Software without restriction, including without limitation
  7. * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  8. * and/or sell copies of the Software, and to permit persons to whom the
  9. * Software is furnished to do so, subject to the following conditions:
  10. *
  11. * The above copyright notice and this permission notice (including the next
  12. * paragraph) shall be included in all copies or substantial portions of the
  13. * Software.
  14. *
  15. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  16. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  18. * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  19. * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  20. * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
  21. * IN THE SOFTWARE.
  22. */
  23. /**
  24. * DOC: Command list validator for VC4.
  25. *
  26. * Since the VC4 has no IOMMU between it and system memory, a user
  27. * with access to execute command lists could escalate privilege by
  28. * overwriting system memory (drawing to it as a framebuffer) or
  29. * reading system memory it shouldn't (reading it as a vertex buffer
  30. * or index buffer)
  31. *
  32. * We validate binner command lists to ensure that all accesses are
  33. * within the bounds of the GEM objects referenced by the submitted
  34. * job. It explicitly whitelists packets, and looks at the offsets in
  35. * any address fields to make sure they're contained within the BOs
  36. * they reference.
  37. *
  38. * Note that because CL validation is already reading the
  39. * user-submitted CL and writing the validated copy out to the memory
  40. * that the GPU will actually read, this is also where GEM relocation
  41. * processing (turning BO references into actual addresses for the GPU
  42. * to use) happens.
  43. */
  44. #include "uapi/drm/vc4_drm.h"
  45. #include "vc4_drv.h"
  46. #include "vc4_packet.h"
  47. #define VALIDATE_ARGS \
  48. struct vc4_exec_info *exec, \
  49. void *validated, \
  50. void *untrusted
  51. /** Return the width in pixels of a 64-byte microtile. */
  52. static uint32_t
  53. utile_width(int cpp)
  54. {
  55. switch (cpp) {
  56. case 1:
  57. case 2:
  58. return 8;
  59. case 4:
  60. return 4;
  61. case 8:
  62. return 2;
  63. default:
  64. DRM_ERROR("unknown cpp: %d\n", cpp);
  65. return 1;
  66. }
  67. }
  68. /** Return the height in pixels of a 64-byte microtile. */
  69. static uint32_t
  70. utile_height(int cpp)
  71. {
  72. switch (cpp) {
  73. case 1:
  74. return 8;
  75. case 2:
  76. case 4:
  77. case 8:
  78. return 4;
  79. default:
  80. DRM_ERROR("unknown cpp: %d\n", cpp);
  81. return 1;
  82. }
  83. }
  84. /**
  85. * size_is_lt() - Returns whether a miplevel of the given size will
  86. * use the lineartile (LT) tiling layout rather than the normal T
  87. * tiling layout.
  88. * @width: Width in pixels of the miplevel
  89. * @height: Height in pixels of the miplevel
  90. * @cpp: Bytes per pixel of the pixel format
  91. */
  92. static bool
  93. size_is_lt(uint32_t width, uint32_t height, int cpp)
  94. {
  95. return (width <= 4 * utile_width(cpp) ||
  96. height <= 4 * utile_height(cpp));
  97. }
  98. struct drm_gem_cma_object *
  99. vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex)
  100. {
  101. struct drm_gem_cma_object *obj;
  102. struct vc4_bo *bo;
  103. if (hindex >= exec->bo_count) {
  104. DRM_DEBUG("BO index %d greater than BO count %d\n",
  105. hindex, exec->bo_count);
  106. return NULL;
  107. }
  108. obj = exec->bo[hindex];
  109. bo = to_vc4_bo(&obj->base);
  110. if (bo->validated_shader) {
  111. DRM_DEBUG("Trying to use shader BO as something other than "
  112. "a shader\n");
  113. return NULL;
  114. }
  115. return obj;
  116. }
  117. static struct drm_gem_cma_object *
  118. vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index)
  119. {
  120. return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]);
  121. }
  122. static bool
  123. validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos)
  124. {
  125. /* Note that the untrusted pointer passed to these functions is
  126. * incremented past the packet byte.
  127. */
  128. return (untrusted - 1 == exec->bin_u + pos);
  129. }
  130. static uint32_t
  131. gl_shader_rec_size(uint32_t pointer_bits)
  132. {
  133. uint32_t attribute_count = pointer_bits & 7;
  134. bool extended = pointer_bits & 8;
  135. if (attribute_count == 0)
  136. attribute_count = 8;
  137. if (extended)
  138. return 100 + attribute_count * 4;
  139. else
  140. return 36 + attribute_count * 8;
  141. }
  142. bool
  143. vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_cma_object *fbo,
  144. uint32_t offset, uint8_t tiling_format,
  145. uint32_t width, uint32_t height, uint8_t cpp)
  146. {
  147. uint32_t aligned_width, aligned_height, stride, size;
  148. uint32_t utile_w = utile_width(cpp);
  149. uint32_t utile_h = utile_height(cpp);
  150. /* The shaded vertex format stores signed 12.4 fixed point
  151. * (-2048,2047) offsets from the viewport center, so we should
  152. * never have a render target larger than 4096. The texture
  153. * unit can only sample from 2048x2048, so it's even more
  154. * restricted. This lets us avoid worrying about overflow in
  155. * our math.
  156. */
  157. if (width > 4096 || height > 4096) {
  158. DRM_DEBUG("Surface dimensions (%d,%d) too large",
  159. width, height);
  160. return false;
  161. }
  162. switch (tiling_format) {
  163. case VC4_TILING_FORMAT_LINEAR:
  164. aligned_width = round_up(width, utile_w);
  165. aligned_height = height;
  166. break;
  167. case VC4_TILING_FORMAT_T:
  168. aligned_width = round_up(width, utile_w * 8);
  169. aligned_height = round_up(height, utile_h * 8);
  170. break;
  171. case VC4_TILING_FORMAT_LT:
  172. aligned_width = round_up(width, utile_w);
  173. aligned_height = round_up(height, utile_h);
  174. break;
  175. default:
  176. DRM_DEBUG("buffer tiling %d unsupported\n", tiling_format);
  177. return false;
  178. }
  179. stride = aligned_width * cpp;
  180. size = stride * aligned_height;
  181. if (size + offset < size ||
  182. size + offset > fbo->base.size) {
  183. DRM_DEBUG("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n",
  184. width, height,
  185. aligned_width, aligned_height,
  186. size, offset, fbo->base.size);
  187. return false;
  188. }
  189. return true;
  190. }
  191. static int
  192. validate_flush(VALIDATE_ARGS)
  193. {
  194. if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) {
  195. DRM_DEBUG("Bin CL must end with VC4_PACKET_FLUSH\n");
  196. return -EINVAL;
  197. }
  198. exec->found_flush = true;
  199. return 0;
  200. }
  201. static int
  202. validate_start_tile_binning(VALIDATE_ARGS)
  203. {
  204. if (exec->found_start_tile_binning_packet) {
  205. DRM_DEBUG("Duplicate VC4_PACKET_START_TILE_BINNING\n");
  206. return -EINVAL;
  207. }
  208. exec->found_start_tile_binning_packet = true;
  209. if (!exec->found_tile_binning_mode_config_packet) {
  210. DRM_DEBUG("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
  211. return -EINVAL;
  212. }
  213. return 0;
  214. }
  215. static int
  216. validate_increment_semaphore(VALIDATE_ARGS)
  217. {
  218. if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) {
  219. DRM_DEBUG("Bin CL must end with "
  220. "VC4_PACKET_INCREMENT_SEMAPHORE\n");
  221. return -EINVAL;
  222. }
  223. exec->found_increment_semaphore_packet = true;
  224. return 0;
  225. }
  226. static int
  227. validate_indexed_prim_list(VALIDATE_ARGS)
  228. {
  229. struct drm_gem_cma_object *ib;
  230. uint32_t length = *(uint32_t *)(untrusted + 1);
  231. uint32_t offset = *(uint32_t *)(untrusted + 5);
  232. uint32_t max_index = *(uint32_t *)(untrusted + 9);
  233. uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1;
  234. struct vc4_shader_state *shader_state;
  235. /* Check overflow condition */
  236. if (exec->shader_state_count == 0) {
  237. DRM_DEBUG("shader state must precede primitives\n");
  238. return -EINVAL;
  239. }
  240. shader_state = &exec->shader_state[exec->shader_state_count - 1];
  241. if (max_index > shader_state->max_index)
  242. shader_state->max_index = max_index;
  243. ib = vc4_use_handle(exec, 0);
  244. if (!ib)
  245. return -EINVAL;
  246. exec->bin_dep_seqno = max(exec->bin_dep_seqno,
  247. to_vc4_bo(&ib->base)->write_seqno);
  248. if (offset > ib->base.size ||
  249. (ib->base.size - offset) / index_size < length) {
  250. DRM_DEBUG("IB access overflow (%d + %d*%d > %zd)\n",
  251. offset, length, index_size, ib->base.size);
  252. return -EINVAL;
  253. }
  254. *(uint32_t *)(validated + 5) = ib->paddr + offset;
  255. return 0;
  256. }
  257. static int
  258. validate_gl_array_primitive(VALIDATE_ARGS)
  259. {
  260. uint32_t length = *(uint32_t *)(untrusted + 1);
  261. uint32_t base_index = *(uint32_t *)(untrusted + 5);
  262. uint32_t max_index;
  263. struct vc4_shader_state *shader_state;
  264. /* Check overflow condition */
  265. if (exec->shader_state_count == 0) {
  266. DRM_DEBUG("shader state must precede primitives\n");
  267. return -EINVAL;
  268. }
  269. shader_state = &exec->shader_state[exec->shader_state_count - 1];
  270. if (length + base_index < length) {
  271. DRM_DEBUG("primitive vertex count overflow\n");
  272. return -EINVAL;
  273. }
  274. max_index = length + base_index - 1;
  275. if (max_index > shader_state->max_index)
  276. shader_state->max_index = max_index;
  277. return 0;
  278. }
  279. static int
  280. validate_gl_shader_state(VALIDATE_ARGS)
  281. {
  282. uint32_t i = exec->shader_state_count++;
  283. if (i >= exec->shader_state_size) {
  284. DRM_DEBUG("More requests for shader states than declared\n");
  285. return -EINVAL;
  286. }
  287. exec->shader_state[i].addr = *(uint32_t *)untrusted;
  288. exec->shader_state[i].max_index = 0;
  289. if (exec->shader_state[i].addr & ~0xf) {
  290. DRM_DEBUG("high bits set in GL shader rec reference\n");
  291. return -EINVAL;
  292. }
  293. *(uint32_t *)validated = (exec->shader_rec_p +
  294. exec->shader_state[i].addr);
  295. exec->shader_rec_p +=
  296. roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16);
  297. return 0;
  298. }
  299. static int
  300. validate_tile_binning_config(VALIDATE_ARGS)
  301. {
  302. struct drm_device *dev = exec->exec_bo->base.dev;
  303. struct vc4_dev *vc4 = to_vc4_dev(dev);
  304. uint8_t flags;
  305. uint32_t tile_state_size;
  306. uint32_t tile_count, bin_addr;
  307. int bin_slot;
  308. if (exec->found_tile_binning_mode_config_packet) {
  309. DRM_DEBUG("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
  310. return -EINVAL;
  311. }
  312. exec->found_tile_binning_mode_config_packet = true;
  313. exec->bin_tiles_x = *(uint8_t *)(untrusted + 12);
  314. exec->bin_tiles_y = *(uint8_t *)(untrusted + 13);
  315. tile_count = exec->bin_tiles_x * exec->bin_tiles_y;
  316. flags = *(uint8_t *)(untrusted + 14);
  317. if (exec->bin_tiles_x == 0 ||
  318. exec->bin_tiles_y == 0) {
  319. DRM_DEBUG("Tile binning config of %dx%d too small\n",
  320. exec->bin_tiles_x, exec->bin_tiles_y);
  321. return -EINVAL;
  322. }
  323. if (flags & (VC4_BIN_CONFIG_DB_NON_MS |
  324. VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) {
  325. DRM_DEBUG("unsupported binning config flags 0x%02x\n", flags);
  326. return -EINVAL;
  327. }
  328. bin_slot = vc4_v3d_get_bin_slot(vc4);
  329. if (bin_slot < 0) {
  330. if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) {
  331. DRM_ERROR("Failed to allocate binner memory: %d\n",
  332. bin_slot);
  333. }
  334. return bin_slot;
  335. }
  336. /* The slot we allocated will only be used by this job, and is
  337. * free when the job completes rendering.
  338. */
  339. exec->bin_slots |= BIT(bin_slot);
  340. bin_addr = vc4->bin_bo->base.paddr + bin_slot * vc4->bin_alloc_size;
  341. /* The tile state data array is 48 bytes per tile, and we put it at
  342. * the start of a BO containing both it and the tile alloc.
  343. */
  344. tile_state_size = 48 * tile_count;
  345. /* Since the tile alloc array will follow us, align. */
  346. exec->tile_alloc_offset = bin_addr + roundup(tile_state_size, 4096);
  347. *(uint8_t *)(validated + 14) =
  348. ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK |
  349. VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) |
  350. VC4_BIN_CONFIG_AUTO_INIT_TSDA |
  351. VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32,
  352. VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) |
  353. VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128,
  354. VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE));
  355. /* tile alloc address. */
  356. *(uint32_t *)(validated + 0) = exec->tile_alloc_offset;
  357. /* tile alloc size. */
  358. *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size -
  359. exec->tile_alloc_offset);
  360. /* tile state address. */
  361. *(uint32_t *)(validated + 8) = bin_addr;
  362. return 0;
  363. }
  364. static int
  365. validate_gem_handles(VALIDATE_ARGS)
  366. {
  367. memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index));
  368. return 0;
  369. }
  370. #define VC4_DEFINE_PACKET(packet, func) \
  371. [packet] = { packet ## _SIZE, #packet, func }
  372. static const struct cmd_info {
  373. uint16_t len;
  374. const char *name;
  375. int (*func)(struct vc4_exec_info *exec, void *validated,
  376. void *untrusted);
  377. } cmd_info[] = {
  378. VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL),
  379. VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL),
  380. VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush),
  381. VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL),
  382. VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING,
  383. validate_start_tile_binning),
  384. VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE,
  385. validate_increment_semaphore),
  386. VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE,
  387. validate_indexed_prim_list),
  388. VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE,
  389. validate_gl_array_primitive),
  390. VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL),
  391. VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state),
  392. VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL),
  393. VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL),
  394. VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL),
  395. VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL),
  396. VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL),
  397. VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL),
  398. VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL),
  399. VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL),
  400. VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL),
  401. /* Note: The docs say this was also 105, but it was 106 in the
  402. * initial userland code drop.
  403. */
  404. VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL),
  405. VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG,
  406. validate_tile_binning_config),
  407. VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles),
  408. };
  409. int
  410. vc4_validate_bin_cl(struct drm_device *dev,
  411. void *validated,
  412. void *unvalidated,
  413. struct vc4_exec_info *exec)
  414. {
  415. uint32_t len = exec->args->bin_cl_size;
  416. uint32_t dst_offset = 0;
  417. uint32_t src_offset = 0;
  418. while (src_offset < len) {
  419. void *dst_pkt = validated + dst_offset;
  420. void *src_pkt = unvalidated + src_offset;
  421. u8 cmd = *(uint8_t *)src_pkt;
  422. const struct cmd_info *info;
  423. if (cmd >= ARRAY_SIZE(cmd_info)) {
  424. DRM_DEBUG("0x%08x: packet %d out of bounds\n",
  425. src_offset, cmd);
  426. return -EINVAL;
  427. }
  428. info = &cmd_info[cmd];
  429. if (!info->name) {
  430. DRM_DEBUG("0x%08x: packet %d invalid\n",
  431. src_offset, cmd);
  432. return -EINVAL;
  433. }
  434. if (src_offset + info->len > len) {
  435. DRM_DEBUG("0x%08x: packet %d (%s) length 0x%08x "
  436. "exceeds bounds (0x%08x)\n",
  437. src_offset, cmd, info->name, info->len,
  438. src_offset + len);
  439. return -EINVAL;
  440. }
  441. if (cmd != VC4_PACKET_GEM_HANDLES)
  442. memcpy(dst_pkt, src_pkt, info->len);
  443. if (info->func && info->func(exec,
  444. dst_pkt + 1,
  445. src_pkt + 1)) {
  446. DRM_DEBUG("0x%08x: packet %d (%s) failed to validate\n",
  447. src_offset, cmd, info->name);
  448. return -EINVAL;
  449. }
  450. src_offset += info->len;
  451. /* GEM handle loading doesn't produce HW packets. */
  452. if (cmd != VC4_PACKET_GEM_HANDLES)
  453. dst_offset += info->len;
  454. /* When the CL hits halt, it'll stop reading anything else. */
  455. if (cmd == VC4_PACKET_HALT)
  456. break;
  457. }
  458. exec->ct0ea = exec->ct0ca + dst_offset;
  459. if (!exec->found_start_tile_binning_packet) {
  460. DRM_DEBUG("Bin CL missing VC4_PACKET_START_TILE_BINNING\n");
  461. return -EINVAL;
  462. }
  463. /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The
  464. * semaphore is used to trigger the render CL to start up, and the
  465. * FLUSH is what caps the bin lists with
  466. * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main
  467. * render CL when they get called to) and actually triggers the queued
  468. * semaphore increment.
  469. */
  470. if (!exec->found_increment_semaphore_packet || !exec->found_flush) {
  471. DRM_DEBUG("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + "
  472. "VC4_PACKET_FLUSH\n");
  473. return -EINVAL;
  474. }
  475. return 0;
  476. }
  477. static bool
  478. reloc_tex(struct vc4_exec_info *exec,
  479. void *uniform_data_u,
  480. struct vc4_texture_sample_info *sample,
  481. uint32_t texture_handle_index, bool is_cs)
  482. {
  483. struct drm_gem_cma_object *tex;
  484. uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
  485. uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]);
  486. uint32_t p2 = (sample->p_offset[2] != ~0 ?
  487. *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0);
  488. uint32_t p3 = (sample->p_offset[3] != ~0 ?
  489. *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0);
  490. uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0];
  491. uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK;
  492. uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS);
  493. uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH);
  494. uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT);
  495. uint32_t cpp, tiling_format, utile_w, utile_h;
  496. uint32_t i;
  497. uint32_t cube_map_stride = 0;
  498. enum vc4_texture_data_type type;
  499. tex = vc4_use_bo(exec, texture_handle_index);
  500. if (!tex)
  501. return false;
  502. if (sample->is_direct) {
  503. uint32_t remaining_size = tex->base.size - p0;
  504. if (p0 > tex->base.size - 4) {
  505. DRM_DEBUG("UBO offset greater than UBO size\n");
  506. goto fail;
  507. }
  508. if (p1 > remaining_size - 4) {
  509. DRM_DEBUG("UBO clamp would allow reads "
  510. "outside of UBO\n");
  511. goto fail;
  512. }
  513. *validated_p0 = tex->paddr + p0;
  514. return true;
  515. }
  516. if (width == 0)
  517. width = 2048;
  518. if (height == 0)
  519. height = 2048;
  520. if (p0 & VC4_TEX_P0_CMMODE_MASK) {
  521. if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) ==
  522. VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE)
  523. cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK;
  524. if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) ==
  525. VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) {
  526. if (cube_map_stride) {
  527. DRM_DEBUG("Cube map stride set twice\n");
  528. goto fail;
  529. }
  530. cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK;
  531. }
  532. if (!cube_map_stride) {
  533. DRM_DEBUG("Cube map stride not set\n");
  534. goto fail;
  535. }
  536. }
  537. type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) |
  538. (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4));
  539. switch (type) {
  540. case VC4_TEXTURE_TYPE_RGBA8888:
  541. case VC4_TEXTURE_TYPE_RGBX8888:
  542. case VC4_TEXTURE_TYPE_RGBA32R:
  543. cpp = 4;
  544. break;
  545. case VC4_TEXTURE_TYPE_RGBA4444:
  546. case VC4_TEXTURE_TYPE_RGBA5551:
  547. case VC4_TEXTURE_TYPE_RGB565:
  548. case VC4_TEXTURE_TYPE_LUMALPHA:
  549. case VC4_TEXTURE_TYPE_S16F:
  550. case VC4_TEXTURE_TYPE_S16:
  551. cpp = 2;
  552. break;
  553. case VC4_TEXTURE_TYPE_LUMINANCE:
  554. case VC4_TEXTURE_TYPE_ALPHA:
  555. case VC4_TEXTURE_TYPE_S8:
  556. cpp = 1;
  557. break;
  558. case VC4_TEXTURE_TYPE_ETC1:
  559. /* ETC1 is arranged as 64-bit blocks, where each block is 4x4
  560. * pixels.
  561. */
  562. cpp = 8;
  563. width = (width + 3) >> 2;
  564. height = (height + 3) >> 2;
  565. break;
  566. case VC4_TEXTURE_TYPE_BW1:
  567. case VC4_TEXTURE_TYPE_A4:
  568. case VC4_TEXTURE_TYPE_A1:
  569. case VC4_TEXTURE_TYPE_RGBA64:
  570. case VC4_TEXTURE_TYPE_YUV422R:
  571. default:
  572. DRM_DEBUG("Texture format %d unsupported\n", type);
  573. goto fail;
  574. }
  575. utile_w = utile_width(cpp);
  576. utile_h = utile_height(cpp);
  577. if (type == VC4_TEXTURE_TYPE_RGBA32R) {
  578. tiling_format = VC4_TILING_FORMAT_LINEAR;
  579. } else {
  580. if (size_is_lt(width, height, cpp))
  581. tiling_format = VC4_TILING_FORMAT_LT;
  582. else
  583. tiling_format = VC4_TILING_FORMAT_T;
  584. }
  585. if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5,
  586. tiling_format, width, height, cpp)) {
  587. goto fail;
  588. }
  589. /* The mipmap levels are stored before the base of the texture. Make
  590. * sure there is actually space in the BO.
  591. */
  592. for (i = 1; i <= miplevels; i++) {
  593. uint32_t level_width = max(width >> i, 1u);
  594. uint32_t level_height = max(height >> i, 1u);
  595. uint32_t aligned_width, aligned_height;
  596. uint32_t level_size;
  597. /* Once the levels get small enough, they drop from T to LT. */
  598. if (tiling_format == VC4_TILING_FORMAT_T &&
  599. size_is_lt(level_width, level_height, cpp)) {
  600. tiling_format = VC4_TILING_FORMAT_LT;
  601. }
  602. switch (tiling_format) {
  603. case VC4_TILING_FORMAT_T:
  604. aligned_width = round_up(level_width, utile_w * 8);
  605. aligned_height = round_up(level_height, utile_h * 8);
  606. break;
  607. case VC4_TILING_FORMAT_LT:
  608. aligned_width = round_up(level_width, utile_w);
  609. aligned_height = round_up(level_height, utile_h);
  610. break;
  611. default:
  612. aligned_width = round_up(level_width, utile_w);
  613. aligned_height = level_height;
  614. break;
  615. }
  616. level_size = aligned_width * cpp * aligned_height;
  617. if (offset < level_size) {
  618. DRM_DEBUG("Level %d (%dx%d -> %dx%d) size %db "
  619. "overflowed buffer bounds (offset %d)\n",
  620. i, level_width, level_height,
  621. aligned_width, aligned_height,
  622. level_size, offset);
  623. goto fail;
  624. }
  625. offset -= level_size;
  626. }
  627. *validated_p0 = tex->paddr + p0;
  628. if (is_cs) {
  629. exec->bin_dep_seqno = max(exec->bin_dep_seqno,
  630. to_vc4_bo(&tex->base)->write_seqno);
  631. }
  632. return true;
  633. fail:
  634. DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
  635. DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1);
  636. DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2);
  637. DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3);
  638. return false;
  639. }
  640. static int
  641. validate_gl_shader_rec(struct drm_device *dev,
  642. struct vc4_exec_info *exec,
  643. struct vc4_shader_state *state)
  644. {
  645. uint32_t *src_handles;
  646. void *pkt_u, *pkt_v;
  647. static const uint32_t shader_reloc_offsets[] = {
  648. 4, /* fs */
  649. 16, /* vs */
  650. 28, /* cs */
  651. };
  652. uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets);
  653. struct drm_gem_cma_object *bo[ARRAY_SIZE(shader_reloc_offsets) + 8];
  654. uint32_t nr_attributes, nr_relocs, packet_size;
  655. int i;
  656. nr_attributes = state->addr & 0x7;
  657. if (nr_attributes == 0)
  658. nr_attributes = 8;
  659. packet_size = gl_shader_rec_size(state->addr);
  660. nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes;
  661. if (nr_relocs * 4 > exec->shader_rec_size) {
  662. DRM_DEBUG("overflowed shader recs reading %d handles "
  663. "from %d bytes left\n",
  664. nr_relocs, exec->shader_rec_size);
  665. return -EINVAL;
  666. }
  667. src_handles = exec->shader_rec_u;
  668. exec->shader_rec_u += nr_relocs * 4;
  669. exec->shader_rec_size -= nr_relocs * 4;
  670. if (packet_size > exec->shader_rec_size) {
  671. DRM_DEBUG("overflowed shader recs copying %db packet "
  672. "from %d bytes left\n",
  673. packet_size, exec->shader_rec_size);
  674. return -EINVAL;
  675. }
  676. pkt_u = exec->shader_rec_u;
  677. pkt_v = exec->shader_rec_v;
  678. memcpy(pkt_v, pkt_u, packet_size);
  679. exec->shader_rec_u += packet_size;
  680. /* Shader recs have to be aligned to 16 bytes (due to the attribute
  681. * flags being in the low bytes), so round the next validated shader
  682. * rec address up. This should be safe, since we've got so many
  683. * relocations in a shader rec packet.
  684. */
  685. BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4);
  686. exec->shader_rec_v += roundup(packet_size, 16);
  687. exec->shader_rec_size -= packet_size;
  688. for (i = 0; i < shader_reloc_count; i++) {
  689. if (src_handles[i] > exec->bo_count) {
  690. DRM_DEBUG("Shader handle %d too big\n", src_handles[i]);
  691. return -EINVAL;
  692. }
  693. bo[i] = exec->bo[src_handles[i]];
  694. if (!bo[i])
  695. return -EINVAL;
  696. }
  697. for (i = shader_reloc_count; i < nr_relocs; i++) {
  698. bo[i] = vc4_use_bo(exec, src_handles[i]);
  699. if (!bo[i])
  700. return -EINVAL;
  701. }
  702. if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) !=
  703. to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) {
  704. DRM_DEBUG("Thread mode of CL and FS do not match\n");
  705. return -EINVAL;
  706. }
  707. if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded ||
  708. to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) {
  709. DRM_DEBUG("cs and vs cannot be threaded\n");
  710. return -EINVAL;
  711. }
  712. for (i = 0; i < shader_reloc_count; i++) {
  713. struct vc4_validated_shader_info *validated_shader;
  714. uint32_t o = shader_reloc_offsets[i];
  715. uint32_t src_offset = *(uint32_t *)(pkt_u + o);
  716. uint32_t *texture_handles_u;
  717. void *uniform_data_u;
  718. uint32_t tex, uni;
  719. *(uint32_t *)(pkt_v + o) = bo[i]->paddr + src_offset;
  720. if (src_offset != 0) {
  721. DRM_DEBUG("Shaders must be at offset 0 of "
  722. "the BO.\n");
  723. return -EINVAL;
  724. }
  725. validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader;
  726. if (!validated_shader)
  727. return -EINVAL;
  728. if (validated_shader->uniforms_src_size >
  729. exec->uniforms_size) {
  730. DRM_DEBUG("Uniforms src buffer overflow\n");
  731. return -EINVAL;
  732. }
  733. texture_handles_u = exec->uniforms_u;
  734. uniform_data_u = (texture_handles_u +
  735. validated_shader->num_texture_samples);
  736. memcpy(exec->uniforms_v, uniform_data_u,
  737. validated_shader->uniforms_size);
  738. for (tex = 0;
  739. tex < validated_shader->num_texture_samples;
  740. tex++) {
  741. if (!reloc_tex(exec,
  742. uniform_data_u,
  743. &validated_shader->texture_samples[tex],
  744. texture_handles_u[tex],
  745. i == 2)) {
  746. return -EINVAL;
  747. }
  748. }
  749. /* Fill in the uniform slots that need this shader's
  750. * start-of-uniforms address (used for resetting the uniform
  751. * stream in the presence of control flow).
  752. */
  753. for (uni = 0;
  754. uni < validated_shader->num_uniform_addr_offsets;
  755. uni++) {
  756. uint32_t o = validated_shader->uniform_addr_offsets[uni];
  757. ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p;
  758. }
  759. *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p;
  760. exec->uniforms_u += validated_shader->uniforms_src_size;
  761. exec->uniforms_v += validated_shader->uniforms_size;
  762. exec->uniforms_p += validated_shader->uniforms_size;
  763. }
  764. for (i = 0; i < nr_attributes; i++) {
  765. struct drm_gem_cma_object *vbo =
  766. bo[ARRAY_SIZE(shader_reloc_offsets) + i];
  767. uint32_t o = 36 + i * 8;
  768. uint32_t offset = *(uint32_t *)(pkt_u + o + 0);
  769. uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1;
  770. uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
  771. uint32_t max_index;
  772. exec->bin_dep_seqno = max(exec->bin_dep_seqno,
  773. to_vc4_bo(&vbo->base)->write_seqno);
  774. if (state->addr & 0x8)
  775. stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
  776. if (vbo->base.size < offset ||
  777. vbo->base.size - offset < attr_size) {
  778. DRM_DEBUG("BO offset overflow (%d + %d > %zu)\n",
  779. offset, attr_size, vbo->base.size);
  780. return -EINVAL;
  781. }
  782. if (stride != 0) {
  783. max_index = ((vbo->base.size - offset - attr_size) /
  784. stride);
  785. if (state->max_index > max_index) {
  786. DRM_DEBUG("primitives use index %d out of "
  787. "supplied %d\n",
  788. state->max_index, max_index);
  789. return -EINVAL;
  790. }
  791. }
  792. *(uint32_t *)(pkt_v + o) = vbo->paddr + offset;
  793. }
  794. return 0;
  795. }
  796. int
  797. vc4_validate_shader_recs(struct drm_device *dev,
  798. struct vc4_exec_info *exec)
  799. {
  800. uint32_t i;
  801. int ret = 0;
  802. for (i = 0; i < exec->shader_state_count; i++) {
  803. ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]);
  804. if (ret)
  805. return ret;
  806. }
  807. return ret;
  808. }