1 /*
2 * Copyright © 2014 Broadcom
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 */
23
24 /**
25 * DOC: Command list validator for VC4.
26 *
27 * Since the VC4 has no IOMMU between it and system memory, a user
28 * with access to execute command lists could escalate privilege by
29 * overwriting system memory (drawing to it as a framebuffer) or
30 * reading system memory it shouldn't (reading it as a vertex buffer
31 * or index buffer)
32 *
33 * We validate binner command lists to ensure that all accesses are
34 * within the bounds of the GEM objects referenced by the submitted
35 * job. It explicitly whitelists packets, and looks at the offsets in
36 * any address fields to make sure they're contained within the BOs
37 * they reference.
38 *
39 * Note that because CL validation is already reading the
40 * user-submitted CL and writing the validated copy out to the memory
41 * that the GPU will actually read, this is also where GEM relocation
42 * processing (turning BO references into actual addresses for the GPU
43 * to use) happens.
44 */
45
46 #include <drm/drm_print.h>
47
48 #include "vc4_drv.h"
49 #include "vc4_packet.h"
50
51 #define VALIDATE_ARGS \
52 struct vc4_exec_info *exec, \
53 void *validated, \
54 void *untrusted
55
56 /** Return the width in pixels of a 64-byte microtile. */
57 static uint32_t
utile_width(int cpp)58 utile_width(int cpp)
59 {
60 switch (cpp) {
61 case 1:
62 case 2:
63 return 8;
64 case 4:
65 return 4;
66 case 8:
67 return 2;
68 default:
69 pr_err("unknown cpp: %d\n", cpp);
70 return 1;
71 }
72 }
73
74 /** Return the height in pixels of a 64-byte microtile. */
75 static uint32_t
utile_height(int cpp)76 utile_height(int cpp)
77 {
78 switch (cpp) {
79 case 1:
80 return 8;
81 case 2:
82 case 4:
83 case 8:
84 return 4;
85 default:
86 pr_err("unknown cpp: %d\n", cpp);
87 return 1;
88 }
89 }
90
91 /**
92 * size_is_lt() - Returns whether a miplevel of the given size will
93 * use the lineartile (LT) tiling layout rather than the normal T
94 * tiling layout.
95 * @width: Width in pixels of the miplevel
96 * @height: Height in pixels of the miplevel
97 * @cpp: Bytes per pixel of the pixel format
98 */
99 static bool
size_is_lt(uint32_t width,uint32_t height,int cpp)100 size_is_lt(uint32_t width, uint32_t height, int cpp)
101 {
102 return (width <= 4 * utile_width(cpp) ||
103 height <= 4 * utile_height(cpp));
104 }
105
106 struct drm_gem_dma_object *
vc4_use_bo(struct vc4_exec_info * exec,uint32_t hindex)107 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex)
108 {
109 struct vc4_dev *vc4 = exec->dev;
110 struct drm_gem_dma_object *obj;
111 struct vc4_bo *bo;
112
113 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
114 return NULL;
115
116 if (hindex >= exec->bo_count) {
117 DRM_DEBUG("BO index %d greater than BO count %d\n",
118 hindex, exec->bo_count);
119 return NULL;
120 }
121 obj = to_drm_gem_dma_obj(exec->bo[hindex]);
122 bo = to_vc4_bo(&obj->base);
123
124 if (bo->validated_shader) {
125 DRM_DEBUG("Trying to use shader BO as something other than "
126 "a shader\n");
127 return NULL;
128 }
129
130 return obj;
131 }
132
133 static struct drm_gem_dma_object *
vc4_use_handle(struct vc4_exec_info * exec,uint32_t gem_handles_packet_index)134 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index)
135 {
136 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]);
137 }
138
139 static bool
validate_bin_pos(struct vc4_exec_info * exec,void * untrusted,uint32_t pos)140 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos)
141 {
142 /* Note that the untrusted pointer passed to these functions is
143 * incremented past the packet byte.
144 */
145 return (untrusted - 1 == exec->bin_u + pos);
146 }
147
148 static uint32_t
gl_shader_rec_size(uint32_t pointer_bits)149 gl_shader_rec_size(uint32_t pointer_bits)
150 {
151 uint32_t attribute_count = pointer_bits & 7;
152 bool extended = pointer_bits & 8;
153
154 if (attribute_count == 0)
155 attribute_count = 8;
156
157 if (extended)
158 return 100 + attribute_count * 4;
159 else
160 return 36 + attribute_count * 8;
161 }
162
163 bool
vc4_check_tex_size(struct vc4_exec_info * exec,struct drm_gem_dma_object * fbo,uint32_t offset,uint8_t tiling_format,uint32_t width,uint32_t height,uint8_t cpp)164 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_dma_object *fbo,
165 uint32_t offset, uint8_t tiling_format,
166 uint32_t width, uint32_t height, uint8_t cpp)
167 {
168 struct vc4_dev *vc4 = exec->dev;
169 uint32_t aligned_width, aligned_height, stride, size;
170 uint32_t utile_w = utile_width(cpp);
171 uint32_t utile_h = utile_height(cpp);
172
173 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
174 return false;
175
176 /* The shaded vertex format stores signed 12.4 fixed point
177 * (-2048,2047) offsets from the viewport center, so we should
178 * never have a render target larger than 4096. The texture
179 * unit can only sample from 2048x2048, so it's even more
180 * restricted. This lets us avoid worrying about overflow in
181 * our math.
182 */
183 if (width > 4096 || height > 4096) {
184 DRM_DEBUG("Surface dimensions (%d,%d) too large",
185 width, height);
186 return false;
187 }
188
189 switch (tiling_format) {
190 case VC4_TILING_FORMAT_LINEAR:
191 aligned_width = round_up(width, utile_w);
192 aligned_height = height;
193 break;
194 case VC4_TILING_FORMAT_T:
195 aligned_width = round_up(width, utile_w * 8);
196 aligned_height = round_up(height, utile_h * 8);
197 break;
198 case VC4_TILING_FORMAT_LT:
199 aligned_width = round_up(width, utile_w);
200 aligned_height = round_up(height, utile_h);
201 break;
202 default:
203 DRM_DEBUG("buffer tiling %d unsupported\n", tiling_format);
204 return false;
205 }
206
207 stride = aligned_width * cpp;
208 size = stride * aligned_height;
209
210 if (size + offset < size ||
211 size + offset > fbo->base.size) {
212 DRM_DEBUG("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n",
213 width, height,
214 aligned_width, aligned_height,
215 size, offset, fbo->base.size);
216 return false;
217 }
218
219 return true;
220 }
221
222 static int
validate_flush(VALIDATE_ARGS)223 validate_flush(VALIDATE_ARGS)
224 {
225 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) {
226 DRM_DEBUG("Bin CL must end with VC4_PACKET_FLUSH\n");
227 return -EINVAL;
228 }
229 exec->found_flush = true;
230
231 return 0;
232 }
233
234 static int
validate_start_tile_binning(VALIDATE_ARGS)235 validate_start_tile_binning(VALIDATE_ARGS)
236 {
237 if (exec->found_start_tile_binning_packet) {
238 DRM_DEBUG("Duplicate VC4_PACKET_START_TILE_BINNING\n");
239 return -EINVAL;
240 }
241 exec->found_start_tile_binning_packet = true;
242
243 if (!exec->found_tile_binning_mode_config_packet) {
244 DRM_DEBUG("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
245 return -EINVAL;
246 }
247
248 return 0;
249 }
250
251 static int
validate_increment_semaphore(VALIDATE_ARGS)252 validate_increment_semaphore(VALIDATE_ARGS)
253 {
254 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) {
255 DRM_DEBUG("Bin CL must end with "
256 "VC4_PACKET_INCREMENT_SEMAPHORE\n");
257 return -EINVAL;
258 }
259 exec->found_increment_semaphore_packet = true;
260
261 return 0;
262 }
263
264 static int
validate_indexed_prim_list(VALIDATE_ARGS)265 validate_indexed_prim_list(VALIDATE_ARGS)
266 {
267 struct drm_gem_dma_object *ib;
268 uint32_t length = *(uint32_t *)(untrusted + 1);
269 uint32_t offset = *(uint32_t *)(untrusted + 5);
270 uint32_t max_index = *(uint32_t *)(untrusted + 9);
271 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1;
272 struct vc4_shader_state *shader_state;
273
274 /* Check overflow condition */
275 if (exec->shader_state_count == 0) {
276 DRM_DEBUG("shader state must precede primitives\n");
277 return -EINVAL;
278 }
279 shader_state = &exec->shader_state[exec->shader_state_count - 1];
280
281 if (max_index > shader_state->max_index)
282 shader_state->max_index = max_index;
283
284 ib = vc4_use_handle(exec, 0);
285 if (!ib)
286 return -EINVAL;
287
288 if (offset > ib->base.size ||
289 (ib->base.size - offset) / index_size < length) {
290 DRM_DEBUG("IB access overflow (%d + %d*%d > %zd)\n",
291 offset, length, index_size, ib->base.size);
292 return -EINVAL;
293 }
294
295 *(uint32_t *)(validated + 5) = ib->dma_addr + offset;
296
297 return 0;
298 }
299
300 static int
validate_gl_array_primitive(VALIDATE_ARGS)301 validate_gl_array_primitive(VALIDATE_ARGS)
302 {
303 uint32_t length = *(uint32_t *)(untrusted + 1);
304 uint32_t base_index = *(uint32_t *)(untrusted + 5);
305 uint32_t max_index;
306 struct vc4_shader_state *shader_state;
307
308 /* Check overflow condition */
309 if (exec->shader_state_count == 0) {
310 DRM_DEBUG("shader state must precede primitives\n");
311 return -EINVAL;
312 }
313 shader_state = &exec->shader_state[exec->shader_state_count - 1];
314
315 if (length + base_index < length) {
316 DRM_DEBUG("primitive vertex count overflow\n");
317 return -EINVAL;
318 }
319 max_index = length + base_index - 1;
320
321 if (max_index > shader_state->max_index)
322 shader_state->max_index = max_index;
323
324 return 0;
325 }
326
327 static int
validate_gl_shader_state(VALIDATE_ARGS)328 validate_gl_shader_state(VALIDATE_ARGS)
329 {
330 uint32_t i = exec->shader_state_count++;
331
332 if (i >= exec->shader_state_size) {
333 DRM_DEBUG("More requests for shader states than declared\n");
334 return -EINVAL;
335 }
336
337 exec->shader_state[i].addr = *(uint32_t *)untrusted;
338 exec->shader_state[i].max_index = 0;
339
340 if (exec->shader_state[i].addr & ~0xf) {
341 DRM_DEBUG("high bits set in GL shader rec reference\n");
342 return -EINVAL;
343 }
344
345 *(uint32_t *)validated = (exec->shader_rec_p +
346 exec->shader_state[i].addr);
347
348 exec->shader_rec_p +=
349 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16);
350
351 return 0;
352 }
353
354 static int
validate_tile_binning_config(VALIDATE_ARGS)355 validate_tile_binning_config(VALIDATE_ARGS)
356 {
357 struct drm_device *dev = exec->exec_bo->base.dev;
358 struct vc4_dev *vc4 = to_vc4_dev(dev);
359 uint8_t flags;
360 uint32_t tile_state_size;
361 uint32_t tile_count, bin_addr;
362 int bin_slot;
363
364 if (exec->found_tile_binning_mode_config_packet) {
365 DRM_DEBUG("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
366 return -EINVAL;
367 }
368 exec->found_tile_binning_mode_config_packet = true;
369
370 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12);
371 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13);
372 tile_count = exec->bin_tiles_x * exec->bin_tiles_y;
373 flags = *(uint8_t *)(untrusted + 14);
374
375 if (exec->bin_tiles_x == 0 ||
376 exec->bin_tiles_y == 0) {
377 DRM_DEBUG("Tile binning config of %dx%d too small\n",
378 exec->bin_tiles_x, exec->bin_tiles_y);
379 return -EINVAL;
380 }
381
382 if (flags & (VC4_BIN_CONFIG_DB_NON_MS |
383 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) {
384 DRM_DEBUG("unsupported binning config flags 0x%02x\n", flags);
385 return -EINVAL;
386 }
387
388 /* The tile state data array is 48 bytes per tile, and we put it at
389 * the start of a BO containing both it and the tile alloc.
390 */
391 tile_state_size = 48 * tile_count;
392
393 /* Since the tile alloc array will follow us, align. */
394 tile_state_size = roundup(tile_state_size, 4096);
395
396 /* Reject configurations whose tile state would leave no room for
397 * the tile alloc pool that follows it in the slot.
398 */
399 if (tile_state_size >= vc4->bin_alloc_size) {
400 DRM_DEBUG("Tile binning config of %dx%d too large\n",
401 exec->bin_tiles_x, exec->bin_tiles_y);
402 return -EINVAL;
403 }
404
405 bin_slot = vc4_v3d_get_bin_slot(vc4);
406 if (bin_slot < 0) {
407 if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) {
408 drm_err(dev, "Failed to allocate binner memory: %d\n",
409 bin_slot);
410 }
411 return bin_slot;
412 }
413
414 /* The slot we allocated will only be used by this job, and is
415 * free when the job completes rendering.
416 */
417 exec->bin_slots |= BIT(bin_slot);
418 bin_addr = vc4->bin_bo->base.dma_addr + bin_slot * vc4->bin_alloc_size;
419
420 exec->tile_alloc_offset = bin_addr + tile_state_size;
421
422 /* The TSDA area must be zeroed out before use, otherwise the PTB might
423 * consume a stale tile state.
424 */
425 memset(vc4->bin_bo->base.vaddr + bin_slot * vc4->bin_alloc_size, 0,
426 tile_state_size);
427
428 *(uint8_t *)(validated + 14) =
429 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK |
430 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) |
431 VC4_BIN_CONFIG_AUTO_INIT_TSDA |
432 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32,
433 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) |
434 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128,
435 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE));
436
437 /* tile alloc address. */
438 *(uint32_t *)(validated + 0) = exec->tile_alloc_offset;
439 /* tile alloc size. */
440 *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size -
441 exec->tile_alloc_offset);
442 /* tile state address. */
443 *(uint32_t *)(validated + 8) = bin_addr;
444
445 return 0;
446 }
447
448 static int
validate_gem_handles(VALIDATE_ARGS)449 validate_gem_handles(VALIDATE_ARGS)
450 {
451 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index));
452 return 0;
453 }
454
455 #define VC4_DEFINE_PACKET(packet, func) \
456 [packet] = { packet ## _SIZE, #packet, func }
457
458 static const struct cmd_info {
459 uint16_t len;
460 const char *name;
461 int (*func)(struct vc4_exec_info *exec, void *validated,
462 void *untrusted);
463 } cmd_info[] = {
464 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL),
465 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL),
466 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush),
467 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL),
468 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING,
469 validate_start_tile_binning),
470 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE,
471 validate_increment_semaphore),
472
473 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE,
474 validate_indexed_prim_list),
475 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE,
476 validate_gl_array_primitive),
477
478 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL),
479
480 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state),
481
482 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL),
483 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL),
484 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL),
485 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL),
486 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL),
487 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL),
488 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL),
489 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL),
490 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL),
491 /* Note: The docs say this was also 105, but it was 106 in the
492 * initial userland code drop.
493 */
494 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL),
495
496 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG,
497 validate_tile_binning_config),
498
499 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles),
500 };
501
502 int
vc4_validate_bin_cl(struct drm_device * dev,void * validated,void * unvalidated,struct vc4_exec_info * exec)503 vc4_validate_bin_cl(struct drm_device *dev,
504 void *validated,
505 void *unvalidated,
506 struct vc4_exec_info *exec)
507 {
508 struct vc4_dev *vc4 = to_vc4_dev(dev);
509 uint32_t len = exec->args->bin_cl_size;
510 uint32_t dst_offset = 0;
511 uint32_t src_offset = 0;
512
513 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
514 return -ENODEV;
515
516 while (src_offset < len) {
517 void *dst_pkt = validated + dst_offset;
518 void *src_pkt = unvalidated + src_offset;
519 u8 cmd = *(uint8_t *)src_pkt;
520 const struct cmd_info *info;
521
522 if (cmd >= ARRAY_SIZE(cmd_info)) {
523 DRM_DEBUG("0x%08x: packet %d out of bounds\n",
524 src_offset, cmd);
525 return -EINVAL;
526 }
527
528 info = &cmd_info[cmd];
529 if (!info->name) {
530 DRM_DEBUG("0x%08x: packet %d invalid\n",
531 src_offset, cmd);
532 return -EINVAL;
533 }
534
535 if (src_offset + info->len > len) {
536 DRM_DEBUG("0x%08x: packet %d (%s) length 0x%08x "
537 "exceeds bounds (0x%08x)\n",
538 src_offset, cmd, info->name, info->len,
539 src_offset + len);
540 return -EINVAL;
541 }
542
543 if (cmd != VC4_PACKET_GEM_HANDLES)
544 memcpy(dst_pkt, src_pkt, info->len);
545
546 if (info->func && info->func(exec,
547 dst_pkt + 1,
548 src_pkt + 1)) {
549 DRM_DEBUG("0x%08x: packet %d (%s) failed to validate\n",
550 src_offset, cmd, info->name);
551 return -EINVAL;
552 }
553
554 src_offset += info->len;
555 /* GEM handle loading doesn't produce HW packets. */
556 if (cmd != VC4_PACKET_GEM_HANDLES)
557 dst_offset += info->len;
558
559 /* When the CL hits halt, it'll stop reading anything else. */
560 if (cmd == VC4_PACKET_HALT)
561 break;
562 }
563
564 exec->ct0ea = exec->ct0ca + dst_offset;
565
566 if (!exec->found_start_tile_binning_packet) {
567 DRM_DEBUG("Bin CL missing VC4_PACKET_START_TILE_BINNING\n");
568 return -EINVAL;
569 }
570
571 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The
572 * semaphore is used to trigger the render CL to start up, and the
573 * FLUSH is what caps the bin lists with
574 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main
575 * render CL when they get called to) and actually triggers the queued
576 * semaphore increment.
577 */
578 if (!exec->found_increment_semaphore_packet || !exec->found_flush) {
579 DRM_DEBUG("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + "
580 "VC4_PACKET_FLUSH\n");
581 return -EINVAL;
582 }
583
584 return 0;
585 }
586
587 static bool
reloc_tex(struct vc4_exec_info * exec,void * uniform_data_u,struct vc4_texture_sample_info * sample,uint32_t texture_handle_index,bool is_cs)588 reloc_tex(struct vc4_exec_info *exec,
589 void *uniform_data_u,
590 struct vc4_texture_sample_info *sample,
591 uint32_t texture_handle_index, bool is_cs)
592 {
593 struct drm_gem_dma_object *tex;
594 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
595 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]);
596 uint32_t p2 = (sample->p_offset[2] != ~0 ?
597 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0);
598 uint32_t p3 = (sample->p_offset[3] != ~0 ?
599 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0);
600 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0];
601 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK;
602 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS);
603 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH);
604 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT);
605 uint32_t cpp, tiling_format, utile_w, utile_h;
606 uint32_t i;
607 uint32_t cube_map_stride = 0;
608 enum vc4_texture_data_type type;
609
610 tex = vc4_use_bo(exec, texture_handle_index);
611 if (!tex)
612 return false;
613
614 if (sample->is_direct) {
615 uint32_t remaining_size = tex->base.size - p0;
616
617 if (p0 > tex->base.size - 4) {
618 DRM_DEBUG("UBO offset greater than UBO size\n");
619 goto fail;
620 }
621 if (p1 > remaining_size - 4) {
622 DRM_DEBUG("UBO clamp would allow reads "
623 "outside of UBO\n");
624 goto fail;
625 }
626 *validated_p0 = tex->dma_addr + p0;
627 return true;
628 }
629
630 if (width == 0)
631 width = 2048;
632 if (height == 0)
633 height = 2048;
634
635 if (p0 & VC4_TEX_P0_CMMODE_MASK) {
636 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) ==
637 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE)
638 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK;
639 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) ==
640 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) {
641 if (cube_map_stride) {
642 DRM_DEBUG("Cube map stride set twice\n");
643 goto fail;
644 }
645
646 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK;
647 }
648 if (!cube_map_stride) {
649 DRM_DEBUG("Cube map stride not set\n");
650 goto fail;
651 }
652 }
653
654 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) |
655 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4));
656
657 switch (type) {
658 case VC4_TEXTURE_TYPE_RGBA8888:
659 case VC4_TEXTURE_TYPE_RGBX8888:
660 case VC4_TEXTURE_TYPE_RGBA32R:
661 cpp = 4;
662 break;
663 case VC4_TEXTURE_TYPE_RGBA4444:
664 case VC4_TEXTURE_TYPE_RGBA5551:
665 case VC4_TEXTURE_TYPE_RGB565:
666 case VC4_TEXTURE_TYPE_LUMALPHA:
667 case VC4_TEXTURE_TYPE_S16F:
668 case VC4_TEXTURE_TYPE_S16:
669 cpp = 2;
670 break;
671 case VC4_TEXTURE_TYPE_LUMINANCE:
672 case VC4_TEXTURE_TYPE_ALPHA:
673 case VC4_TEXTURE_TYPE_S8:
674 cpp = 1;
675 break;
676 case VC4_TEXTURE_TYPE_ETC1:
677 /* ETC1 is arranged as 64-bit blocks, where each block is 4x4
678 * pixels.
679 */
680 cpp = 8;
681 width = (width + 3) >> 2;
682 height = (height + 3) >> 2;
683 break;
684 case VC4_TEXTURE_TYPE_BW1:
685 case VC4_TEXTURE_TYPE_A4:
686 case VC4_TEXTURE_TYPE_A1:
687 case VC4_TEXTURE_TYPE_RGBA64:
688 case VC4_TEXTURE_TYPE_YUV422R:
689 default:
690 DRM_DEBUG("Texture format %d unsupported\n", type);
691 goto fail;
692 }
693 utile_w = utile_width(cpp);
694 utile_h = utile_height(cpp);
695
696 if (type == VC4_TEXTURE_TYPE_RGBA32R) {
697 tiling_format = VC4_TILING_FORMAT_LINEAR;
698 } else {
699 if (size_is_lt(width, height, cpp))
700 tiling_format = VC4_TILING_FORMAT_LT;
701 else
702 tiling_format = VC4_TILING_FORMAT_T;
703 }
704
705 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5,
706 tiling_format, width, height, cpp)) {
707 goto fail;
708 }
709
710 /* The mipmap levels are stored before the base of the texture. Make
711 * sure there is actually space in the BO.
712 */
713 for (i = 1; i <= miplevels; i++) {
714 uint32_t level_width = max(width >> i, 1u);
715 uint32_t level_height = max(height >> i, 1u);
716 uint32_t aligned_width, aligned_height;
717 uint32_t level_size;
718
719 /* Once the levels get small enough, they drop from T to LT. */
720 if (tiling_format == VC4_TILING_FORMAT_T &&
721 size_is_lt(level_width, level_height, cpp)) {
722 tiling_format = VC4_TILING_FORMAT_LT;
723 }
724
725 switch (tiling_format) {
726 case VC4_TILING_FORMAT_T:
727 aligned_width = round_up(level_width, utile_w * 8);
728 aligned_height = round_up(level_height, utile_h * 8);
729 break;
730 case VC4_TILING_FORMAT_LT:
731 aligned_width = round_up(level_width, utile_w);
732 aligned_height = round_up(level_height, utile_h);
733 break;
734 default:
735 aligned_width = round_up(level_width, utile_w);
736 aligned_height = level_height;
737 break;
738 }
739
740 level_size = aligned_width * cpp * aligned_height;
741
742 if (offset < level_size) {
743 DRM_DEBUG("Level %d (%dx%d -> %dx%d) size %db "
744 "overflowed buffer bounds (offset %d)\n",
745 i, level_width, level_height,
746 aligned_width, aligned_height,
747 level_size, offset);
748 goto fail;
749 }
750
751 offset -= level_size;
752 }
753
754 *validated_p0 = tex->dma_addr + p0;
755
756 return true;
757 fail:
758 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
759 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1);
760 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2);
761 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3);
762 return false;
763 }
764
765 static int
validate_gl_shader_rec(struct drm_device * dev,struct vc4_exec_info * exec,struct vc4_shader_state * state)766 validate_gl_shader_rec(struct drm_device *dev,
767 struct vc4_exec_info *exec,
768 struct vc4_shader_state *state)
769 {
770 uint32_t *src_handles;
771 void *pkt_u, *pkt_v;
772 static const uint32_t shader_reloc_offsets[] = {
773 4, /* fs */
774 16, /* vs */
775 28, /* cs */
776 };
777 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets);
778 struct drm_gem_dma_object *bo[ARRAY_SIZE(shader_reloc_offsets) + 8];
779 uint32_t nr_attributes, nr_relocs, packet_size;
780 int i;
781
782 nr_attributes = state->addr & 0x7;
783 if (nr_attributes == 0)
784 nr_attributes = 8;
785 packet_size = gl_shader_rec_size(state->addr);
786
787 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes;
788 if (nr_relocs * 4 > exec->shader_rec_size) {
789 DRM_DEBUG("overflowed shader recs reading %d handles "
790 "from %d bytes left\n",
791 nr_relocs, exec->shader_rec_size);
792 return -EINVAL;
793 }
794 src_handles = exec->shader_rec_u;
795 exec->shader_rec_u += nr_relocs * 4;
796 exec->shader_rec_size -= nr_relocs * 4;
797
798 if (packet_size > exec->shader_rec_size) {
799 DRM_DEBUG("overflowed shader recs copying %db packet "
800 "from %d bytes left\n",
801 packet_size, exec->shader_rec_size);
802 return -EINVAL;
803 }
804 pkt_u = exec->shader_rec_u;
805 pkt_v = exec->shader_rec_v;
806 memcpy(pkt_v, pkt_u, packet_size);
807 exec->shader_rec_u += packet_size;
808 /* Shader recs have to be aligned to 16 bytes (due to the attribute
809 * flags being in the low bytes), so round the next validated shader
810 * rec address up. This should be safe, since we've got so many
811 * relocations in a shader rec packet.
812 */
813 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4);
814 exec->shader_rec_v += roundup(packet_size, 16);
815 exec->shader_rec_size -= packet_size;
816
817 for (i = 0; i < shader_reloc_count; i++) {
818 if (src_handles[i] > exec->bo_count) {
819 DRM_DEBUG("Shader handle %d too big\n", src_handles[i]);
820 return -EINVAL;
821 }
822
823 bo[i] = to_drm_gem_dma_obj(exec->bo[src_handles[i]]);
824 if (!bo[i])
825 return -EINVAL;
826 }
827 for (i = shader_reloc_count; i < nr_relocs; i++) {
828 bo[i] = vc4_use_bo(exec, src_handles[i]);
829 if (!bo[i])
830 return -EINVAL;
831 }
832
833 if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) !=
834 to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) {
835 DRM_DEBUG("Thread mode of CL and FS do not match\n");
836 return -EINVAL;
837 }
838
839 if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded ||
840 to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) {
841 DRM_DEBUG("cs and vs cannot be threaded\n");
842 return -EINVAL;
843 }
844
845 for (i = 0; i < shader_reloc_count; i++) {
846 struct vc4_validated_shader_info *validated_shader;
847 uint32_t o = shader_reloc_offsets[i];
848 uint32_t src_offset = *(uint32_t *)(pkt_u + o);
849 uint32_t *texture_handles_u;
850 void *uniform_data_u;
851 uint32_t tex, uni;
852
853 *(uint32_t *)(pkt_v + o) = bo[i]->dma_addr + src_offset;
854
855 if (src_offset != 0) {
856 DRM_DEBUG("Shaders must be at offset 0 of "
857 "the BO.\n");
858 return -EINVAL;
859 }
860
861 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader;
862 if (!validated_shader)
863 return -EINVAL;
864
865 if (validated_shader->uniforms_src_size >
866 exec->uniforms_size) {
867 DRM_DEBUG("Uniforms src buffer overflow\n");
868 return -EINVAL;
869 }
870
871 texture_handles_u = exec->uniforms_u;
872 uniform_data_u = (texture_handles_u +
873 validated_shader->num_texture_samples);
874
875 memcpy(exec->uniforms_v, uniform_data_u,
876 validated_shader->uniforms_size);
877
878 for (tex = 0;
879 tex < validated_shader->num_texture_samples;
880 tex++) {
881 if (!reloc_tex(exec,
882 uniform_data_u,
883 &validated_shader->texture_samples[tex],
884 texture_handles_u[tex],
885 i == 2)) {
886 return -EINVAL;
887 }
888 }
889
890 /* Fill in the uniform slots that need this shader's
891 * start-of-uniforms address (used for resetting the uniform
892 * stream in the presence of control flow).
893 */
894 for (uni = 0;
895 uni < validated_shader->num_uniform_addr_offsets;
896 uni++) {
897 uint32_t o = validated_shader->uniform_addr_offsets[uni];
898 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p;
899 }
900
901 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p;
902
903 exec->uniforms_u += validated_shader->uniforms_src_size;
904 exec->uniforms_v += validated_shader->uniforms_size;
905 exec->uniforms_p += validated_shader->uniforms_size;
906 }
907
908 for (i = 0; i < nr_attributes; i++) {
909 struct drm_gem_dma_object *vbo =
910 bo[ARRAY_SIZE(shader_reloc_offsets) + i];
911 uint32_t o = 36 + i * 8;
912 uint32_t offset = *(uint32_t *)(pkt_u + o + 0);
913 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1;
914 uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
915 uint32_t max_index;
916
917 if (state->addr & 0x8)
918 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
919
920 if (vbo->base.size < offset ||
921 vbo->base.size - offset < attr_size) {
922 DRM_DEBUG("BO offset overflow (%d + %d > %zu)\n",
923 offset, attr_size, vbo->base.size);
924 return -EINVAL;
925 }
926
927 if (stride != 0) {
928 max_index = ((vbo->base.size - offset - attr_size) /
929 stride);
930 if (state->max_index > max_index) {
931 DRM_DEBUG("primitives use index %d out of "
932 "supplied %d\n",
933 state->max_index, max_index);
934 return -EINVAL;
935 }
936 }
937
938 *(uint32_t *)(pkt_v + o) = vbo->dma_addr + offset;
939 }
940
941 return 0;
942 }
943
944 int
vc4_validate_shader_recs(struct drm_device * dev,struct vc4_exec_info * exec)945 vc4_validate_shader_recs(struct drm_device *dev,
946 struct vc4_exec_info *exec)
947 {
948 struct vc4_dev *vc4 = to_vc4_dev(dev);
949 uint32_t i;
950 int ret = 0;
951
952 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
953 return -ENODEV;
954
955 for (i = 0; i < exec->shader_state_count; i++) {
956 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]);
957 if (ret)
958 return ret;
959 }
960
961 return ret;
962 }
963