1 /* 2 * Copyright © 2014 Broadcom 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 */ 23 24 /** 25 * DOC: Command list validator for VC4. 26 * 27 * Since the VC4 has no IOMMU between it and system memory, a user 28 * with access to execute command lists could escalate privilege by 29 * overwriting system memory (drawing to it as a framebuffer) or 30 * reading system memory it shouldn't (reading it as a vertex buffer 31 * or index buffer) 32 * 33 * We validate binner command lists to ensure that all accesses are 34 * within the bounds of the GEM objects referenced by the submitted 35 * job. It explicitly whitelists packets, and looks at the offsets in 36 * any address fields to make sure they're contained within the BOs 37 * they reference. 38 * 39 * Note that because CL validation is already reading the 40 * user-submitted CL and writing the validated copy out to the memory 41 * that the GPU will actually read, this is also where GEM relocation 42 * processing (turning BO references into actual addresses for the GPU 43 * to use) happens. 44 */ 45 46 #include <drm/drm_print.h> 47 48 #include "vc4_drv.h" 49 #include "vc4_packet.h" 50 51 #define VALIDATE_ARGS \ 52 struct vc4_exec_info *exec, \ 53 void *validated, \ 54 void *untrusted 55 56 /** Return the width in pixels of a 64-byte microtile. */ 57 static uint32_t 58 utile_width(int cpp) 59 { 60 switch (cpp) { 61 case 1: 62 case 2: 63 return 8; 64 case 4: 65 return 4; 66 case 8: 67 return 2; 68 default: 69 pr_err("unknown cpp: %d\n", cpp); 70 return 1; 71 } 72 } 73 74 /** Return the height in pixels of a 64-byte microtile. */ 75 static uint32_t 76 utile_height(int cpp) 77 { 78 switch (cpp) { 79 case 1: 80 return 8; 81 case 2: 82 case 4: 83 case 8: 84 return 4; 85 default: 86 pr_err("unknown cpp: %d\n", cpp); 87 return 1; 88 } 89 } 90 91 /** 92 * size_is_lt() - Returns whether a miplevel of the given size will 93 * use the lineartile (LT) tiling layout rather than the normal T 94 * tiling layout. 95 * @width: Width in pixels of the miplevel 96 * @height: Height in pixels of the miplevel 97 * @cpp: Bytes per pixel of the pixel format 98 */ 99 static bool 100 size_is_lt(uint32_t width, uint32_t height, int cpp) 101 { 102 return (width <= 4 * utile_width(cpp) || 103 height <= 4 * utile_height(cpp)); 104 } 105 106 struct drm_gem_dma_object * 107 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex) 108 { 109 struct vc4_dev *vc4 = exec->dev; 110 struct drm_gem_dma_object *obj; 111 struct vc4_bo *bo; 112 113 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4)) 114 return NULL; 115 116 if (hindex >= exec->bo_count) { 117 DRM_DEBUG("BO index %d greater than BO count %d\n", 118 hindex, exec->bo_count); 119 return NULL; 120 } 121 obj = to_drm_gem_dma_obj(exec->bo[hindex]); 122 bo = to_vc4_bo(&obj->base); 123 124 if (bo->validated_shader) { 125 DRM_DEBUG("Trying to use shader BO as something other than " 126 "a shader\n"); 127 return NULL; 128 } 129 130 return obj; 131 } 132 133 static struct drm_gem_dma_object * 134 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index) 135 { 136 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]); 137 } 138 139 static bool 140 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos) 141 { 142 /* Note that the untrusted pointer passed to these functions is 143 * incremented past the packet byte. 144 */ 145 return (untrusted - 1 == exec->bin_u + pos); 146 } 147 148 static uint32_t 149 gl_shader_rec_size(uint32_t pointer_bits) 150 { 151 uint32_t attribute_count = pointer_bits & 7; 152 bool extended = pointer_bits & 8; 153 154 if (attribute_count == 0) 155 attribute_count = 8; 156 157 if (extended) 158 return 100 + attribute_count * 4; 159 else 160 return 36 + attribute_count * 8; 161 } 162 163 bool 164 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_dma_object *fbo, 165 uint32_t offset, uint8_t tiling_format, 166 uint32_t width, uint32_t height, uint8_t cpp) 167 { 168 struct vc4_dev *vc4 = exec->dev; 169 uint32_t aligned_width, aligned_height, stride, size; 170 uint32_t utile_w = utile_width(cpp); 171 uint32_t utile_h = utile_height(cpp); 172 173 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4)) 174 return false; 175 176 /* The shaded vertex format stores signed 12.4 fixed point 177 * (-2048,2047) offsets from the viewport center, so we should 178 * never have a render target larger than 4096. The texture 179 * unit can only sample from 2048x2048, so it's even more 180 * restricted. This lets us avoid worrying about overflow in 181 * our math. 182 */ 183 if (width > 4096 || height > 4096) { 184 DRM_DEBUG("Surface dimensions (%d,%d) too large", 185 width, height); 186 return false; 187 } 188 189 switch (tiling_format) { 190 case VC4_TILING_FORMAT_LINEAR: 191 aligned_width = round_up(width, utile_w); 192 aligned_height = height; 193 break; 194 case VC4_TILING_FORMAT_T: 195 aligned_width = round_up(width, utile_w * 8); 196 aligned_height = round_up(height, utile_h * 8); 197 break; 198 case VC4_TILING_FORMAT_LT: 199 aligned_width = round_up(width, utile_w); 200 aligned_height = round_up(height, utile_h); 201 break; 202 default: 203 DRM_DEBUG("buffer tiling %d unsupported\n", tiling_format); 204 return false; 205 } 206 207 stride = aligned_width * cpp; 208 size = stride * aligned_height; 209 210 if (size + offset < size || 211 size + offset > fbo->base.size) { 212 DRM_DEBUG("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n", 213 width, height, 214 aligned_width, aligned_height, 215 size, offset, fbo->base.size); 216 return false; 217 } 218 219 return true; 220 } 221 222 static int 223 validate_flush(VALIDATE_ARGS) 224 { 225 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) { 226 DRM_DEBUG("Bin CL must end with VC4_PACKET_FLUSH\n"); 227 return -EINVAL; 228 } 229 exec->found_flush = true; 230 231 return 0; 232 } 233 234 static int 235 validate_start_tile_binning(VALIDATE_ARGS) 236 { 237 if (exec->found_start_tile_binning_packet) { 238 DRM_DEBUG("Duplicate VC4_PACKET_START_TILE_BINNING\n"); 239 return -EINVAL; 240 } 241 exec->found_start_tile_binning_packet = true; 242 243 if (!exec->found_tile_binning_mode_config_packet) { 244 DRM_DEBUG("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 245 return -EINVAL; 246 } 247 248 return 0; 249 } 250 251 static int 252 validate_increment_semaphore(VALIDATE_ARGS) 253 { 254 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) { 255 DRM_DEBUG("Bin CL must end with " 256 "VC4_PACKET_INCREMENT_SEMAPHORE\n"); 257 return -EINVAL; 258 } 259 exec->found_increment_semaphore_packet = true; 260 261 return 0; 262 } 263 264 static int 265 validate_indexed_prim_list(VALIDATE_ARGS) 266 { 267 struct drm_gem_dma_object *ib; 268 uint32_t length = *(uint32_t *)(untrusted + 1); 269 uint32_t offset = *(uint32_t *)(untrusted + 5); 270 uint32_t max_index = *(uint32_t *)(untrusted + 9); 271 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1; 272 struct vc4_shader_state *shader_state; 273 274 /* Check overflow condition */ 275 if (exec->shader_state_count == 0) { 276 DRM_DEBUG("shader state must precede primitives\n"); 277 return -EINVAL; 278 } 279 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 280 281 if (max_index > shader_state->max_index) 282 shader_state->max_index = max_index; 283 284 ib = vc4_use_handle(exec, 0); 285 if (!ib) 286 return -EINVAL; 287 288 if (offset > ib->base.size || 289 (ib->base.size - offset) / index_size < length) { 290 DRM_DEBUG("IB access overflow (%d + %d*%d > %zd)\n", 291 offset, length, index_size, ib->base.size); 292 return -EINVAL; 293 } 294 295 *(uint32_t *)(validated + 5) = ib->dma_addr + offset; 296 297 return 0; 298 } 299 300 static int 301 validate_gl_array_primitive(VALIDATE_ARGS) 302 { 303 uint32_t length = *(uint32_t *)(untrusted + 1); 304 uint32_t base_index = *(uint32_t *)(untrusted + 5); 305 uint32_t max_index; 306 struct vc4_shader_state *shader_state; 307 308 /* Check overflow condition */ 309 if (exec->shader_state_count == 0) { 310 DRM_DEBUG("shader state must precede primitives\n"); 311 return -EINVAL; 312 } 313 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 314 315 if (length + base_index < length) { 316 DRM_DEBUG("primitive vertex count overflow\n"); 317 return -EINVAL; 318 } 319 max_index = length + base_index - 1; 320 321 if (max_index > shader_state->max_index) 322 shader_state->max_index = max_index; 323 324 return 0; 325 } 326 327 static int 328 validate_gl_shader_state(VALIDATE_ARGS) 329 { 330 uint32_t i = exec->shader_state_count++; 331 332 if (i >= exec->shader_state_size) { 333 DRM_DEBUG("More requests for shader states than declared\n"); 334 return -EINVAL; 335 } 336 337 exec->shader_state[i].addr = *(uint32_t *)untrusted; 338 exec->shader_state[i].max_index = 0; 339 340 if (exec->shader_state[i].addr & ~0xf) { 341 DRM_DEBUG("high bits set in GL shader rec reference\n"); 342 return -EINVAL; 343 } 344 345 *(uint32_t *)validated = (exec->shader_rec_p + 346 exec->shader_state[i].addr); 347 348 exec->shader_rec_p += 349 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16); 350 351 return 0; 352 } 353 354 static int 355 validate_tile_binning_config(VALIDATE_ARGS) 356 { 357 struct drm_device *dev = exec->exec_bo->base.dev; 358 struct vc4_dev *vc4 = to_vc4_dev(dev); 359 uint8_t flags; 360 uint32_t tile_state_size; 361 uint32_t tile_count, bin_addr; 362 int bin_slot; 363 364 if (exec->found_tile_binning_mode_config_packet) { 365 DRM_DEBUG("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 366 return -EINVAL; 367 } 368 exec->found_tile_binning_mode_config_packet = true; 369 370 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12); 371 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13); 372 tile_count = exec->bin_tiles_x * exec->bin_tiles_y; 373 flags = *(uint8_t *)(untrusted + 14); 374 375 if (exec->bin_tiles_x == 0 || 376 exec->bin_tiles_y == 0) { 377 DRM_DEBUG("Tile binning config of %dx%d too small\n", 378 exec->bin_tiles_x, exec->bin_tiles_y); 379 return -EINVAL; 380 } 381 382 if (flags & (VC4_BIN_CONFIG_DB_NON_MS | 383 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) { 384 DRM_DEBUG("unsupported binning config flags 0x%02x\n", flags); 385 return -EINVAL; 386 } 387 388 /* The tile state data array is 48 bytes per tile, and we put it at 389 * the start of a BO containing both it and the tile alloc. 390 */ 391 tile_state_size = 48 * tile_count; 392 393 /* Since the tile alloc array will follow us, align. */ 394 tile_state_size = roundup(tile_state_size, 4096); 395 396 /* Reject configurations whose tile state would leave no room for 397 * the tile alloc pool that follows it in the slot. 398 */ 399 if (tile_state_size >= vc4->bin_alloc_size) { 400 DRM_DEBUG("Tile binning config of %dx%d too large\n", 401 exec->bin_tiles_x, exec->bin_tiles_y); 402 return -EINVAL; 403 } 404 405 bin_slot = vc4_v3d_get_bin_slot(vc4); 406 if (bin_slot < 0) { 407 if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) { 408 drm_err(dev, "Failed to allocate binner memory: %d\n", 409 bin_slot); 410 } 411 return bin_slot; 412 } 413 414 /* The slot we allocated will only be used by this job, and is 415 * free when the job completes rendering. 416 */ 417 exec->bin_slots |= BIT(bin_slot); 418 bin_addr = vc4->bin_bo->base.dma_addr + bin_slot * vc4->bin_alloc_size; 419 420 exec->tile_alloc_offset = bin_addr + tile_state_size; 421 422 /* The TSDA area must be zeroed out before use, otherwise the PTB might 423 * consume a stale tile state. 424 */ 425 memset(vc4->bin_bo->base.vaddr + bin_slot * vc4->bin_alloc_size, 0, 426 tile_state_size); 427 428 *(uint8_t *)(validated + 14) = 429 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK | 430 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) | 431 VC4_BIN_CONFIG_AUTO_INIT_TSDA | 432 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32, 433 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) | 434 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128, 435 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE)); 436 437 /* tile alloc address. */ 438 *(uint32_t *)(validated + 0) = exec->tile_alloc_offset; 439 /* tile alloc size. */ 440 *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size - 441 exec->tile_alloc_offset); 442 /* tile state address. */ 443 *(uint32_t *)(validated + 8) = bin_addr; 444 445 return 0; 446 } 447 448 static int 449 validate_gem_handles(VALIDATE_ARGS) 450 { 451 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index)); 452 return 0; 453 } 454 455 #define VC4_DEFINE_PACKET(packet, func) \ 456 [packet] = { packet ## _SIZE, #packet, func } 457 458 static const struct cmd_info { 459 uint16_t len; 460 const char *name; 461 int (*func)(struct vc4_exec_info *exec, void *validated, 462 void *untrusted); 463 } cmd_info[] = { 464 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL), 465 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL), 466 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush), 467 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL), 468 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING, 469 validate_start_tile_binning), 470 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE, 471 validate_increment_semaphore), 472 473 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE, 474 validate_indexed_prim_list), 475 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE, 476 validate_gl_array_primitive), 477 478 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL), 479 480 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state), 481 482 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL), 483 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL), 484 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL), 485 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL), 486 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL), 487 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL), 488 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL), 489 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL), 490 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL), 491 /* Note: The docs say this was also 105, but it was 106 in the 492 * initial userland code drop. 493 */ 494 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL), 495 496 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG, 497 validate_tile_binning_config), 498 499 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles), 500 }; 501 502 int 503 vc4_validate_bin_cl(struct drm_device *dev, 504 void *validated, 505 void *unvalidated, 506 struct vc4_exec_info *exec) 507 { 508 struct vc4_dev *vc4 = to_vc4_dev(dev); 509 uint32_t len = exec->args->bin_cl_size; 510 uint32_t dst_offset = 0; 511 uint32_t src_offset = 0; 512 513 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4)) 514 return -ENODEV; 515 516 while (src_offset < len) { 517 void *dst_pkt = validated + dst_offset; 518 void *src_pkt = unvalidated + src_offset; 519 u8 cmd = *(uint8_t *)src_pkt; 520 const struct cmd_info *info; 521 522 if (cmd >= ARRAY_SIZE(cmd_info)) { 523 DRM_DEBUG("0x%08x: packet %d out of bounds\n", 524 src_offset, cmd); 525 return -EINVAL; 526 } 527 528 info = &cmd_info[cmd]; 529 if (!info->name) { 530 DRM_DEBUG("0x%08x: packet %d invalid\n", 531 src_offset, cmd); 532 return -EINVAL; 533 } 534 535 if (src_offset + info->len > len) { 536 DRM_DEBUG("0x%08x: packet %d (%s) length 0x%08x " 537 "exceeds bounds (0x%08x)\n", 538 src_offset, cmd, info->name, info->len, 539 src_offset + len); 540 return -EINVAL; 541 } 542 543 if (cmd != VC4_PACKET_GEM_HANDLES) 544 memcpy(dst_pkt, src_pkt, info->len); 545 546 if (info->func && info->func(exec, 547 dst_pkt + 1, 548 src_pkt + 1)) { 549 DRM_DEBUG("0x%08x: packet %d (%s) failed to validate\n", 550 src_offset, cmd, info->name); 551 return -EINVAL; 552 } 553 554 src_offset += info->len; 555 /* GEM handle loading doesn't produce HW packets. */ 556 if (cmd != VC4_PACKET_GEM_HANDLES) 557 dst_offset += info->len; 558 559 /* When the CL hits halt, it'll stop reading anything else. */ 560 if (cmd == VC4_PACKET_HALT) 561 break; 562 } 563 564 exec->ct0ea = exec->ct0ca + dst_offset; 565 566 if (!exec->found_start_tile_binning_packet) { 567 DRM_DEBUG("Bin CL missing VC4_PACKET_START_TILE_BINNING\n"); 568 return -EINVAL; 569 } 570 571 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The 572 * semaphore is used to trigger the render CL to start up, and the 573 * FLUSH is what caps the bin lists with 574 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main 575 * render CL when they get called to) and actually triggers the queued 576 * semaphore increment. 577 */ 578 if (!exec->found_increment_semaphore_packet || !exec->found_flush) { 579 DRM_DEBUG("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + " 580 "VC4_PACKET_FLUSH\n"); 581 return -EINVAL; 582 } 583 584 return 0; 585 } 586 587 static bool 588 reloc_tex(struct vc4_exec_info *exec, 589 void *uniform_data_u, 590 struct vc4_texture_sample_info *sample, 591 uint32_t texture_handle_index, bool is_cs) 592 { 593 struct drm_gem_dma_object *tex; 594 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]); 595 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]); 596 uint32_t p2 = (sample->p_offset[2] != ~0 ? 597 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0); 598 uint32_t p3 = (sample->p_offset[3] != ~0 ? 599 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0); 600 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0]; 601 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK; 602 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS); 603 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH); 604 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT); 605 uint32_t cpp, tiling_format, utile_w, utile_h; 606 uint32_t i; 607 uint32_t cube_map_stride = 0; 608 enum vc4_texture_data_type type; 609 610 tex = vc4_use_bo(exec, texture_handle_index); 611 if (!tex) 612 return false; 613 614 if (sample->is_direct) { 615 uint32_t remaining_size = tex->base.size - p0; 616 617 if (p0 > tex->base.size - 4) { 618 DRM_DEBUG("UBO offset greater than UBO size\n"); 619 goto fail; 620 } 621 if (p1 > remaining_size - 4) { 622 DRM_DEBUG("UBO clamp would allow reads " 623 "outside of UBO\n"); 624 goto fail; 625 } 626 *validated_p0 = tex->dma_addr + p0; 627 return true; 628 } 629 630 if (width == 0) 631 width = 2048; 632 if (height == 0) 633 height = 2048; 634 635 if (p0 & VC4_TEX_P0_CMMODE_MASK) { 636 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) == 637 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) 638 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK; 639 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) == 640 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) { 641 if (cube_map_stride) { 642 DRM_DEBUG("Cube map stride set twice\n"); 643 goto fail; 644 } 645 646 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK; 647 } 648 if (!cube_map_stride) { 649 DRM_DEBUG("Cube map stride not set\n"); 650 goto fail; 651 } 652 } 653 654 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) | 655 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4)); 656 657 switch (type) { 658 case VC4_TEXTURE_TYPE_RGBA8888: 659 case VC4_TEXTURE_TYPE_RGBX8888: 660 case VC4_TEXTURE_TYPE_RGBA32R: 661 cpp = 4; 662 break; 663 case VC4_TEXTURE_TYPE_RGBA4444: 664 case VC4_TEXTURE_TYPE_RGBA5551: 665 case VC4_TEXTURE_TYPE_RGB565: 666 case VC4_TEXTURE_TYPE_LUMALPHA: 667 case VC4_TEXTURE_TYPE_S16F: 668 case VC4_TEXTURE_TYPE_S16: 669 cpp = 2; 670 break; 671 case VC4_TEXTURE_TYPE_LUMINANCE: 672 case VC4_TEXTURE_TYPE_ALPHA: 673 case VC4_TEXTURE_TYPE_S8: 674 cpp = 1; 675 break; 676 case VC4_TEXTURE_TYPE_ETC1: 677 /* ETC1 is arranged as 64-bit blocks, where each block is 4x4 678 * pixels. 679 */ 680 cpp = 8; 681 width = (width + 3) >> 2; 682 height = (height + 3) >> 2; 683 break; 684 case VC4_TEXTURE_TYPE_BW1: 685 case VC4_TEXTURE_TYPE_A4: 686 case VC4_TEXTURE_TYPE_A1: 687 case VC4_TEXTURE_TYPE_RGBA64: 688 case VC4_TEXTURE_TYPE_YUV422R: 689 default: 690 DRM_DEBUG("Texture format %d unsupported\n", type); 691 goto fail; 692 } 693 utile_w = utile_width(cpp); 694 utile_h = utile_height(cpp); 695 696 if (type == VC4_TEXTURE_TYPE_RGBA32R) { 697 tiling_format = VC4_TILING_FORMAT_LINEAR; 698 } else { 699 if (size_is_lt(width, height, cpp)) 700 tiling_format = VC4_TILING_FORMAT_LT; 701 else 702 tiling_format = VC4_TILING_FORMAT_T; 703 } 704 705 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5, 706 tiling_format, width, height, cpp)) { 707 goto fail; 708 } 709 710 /* The mipmap levels are stored before the base of the texture. Make 711 * sure there is actually space in the BO. 712 */ 713 for (i = 1; i <= miplevels; i++) { 714 uint32_t level_width = max(width >> i, 1u); 715 uint32_t level_height = max(height >> i, 1u); 716 uint32_t aligned_width, aligned_height; 717 uint32_t level_size; 718 719 /* Once the levels get small enough, they drop from T to LT. */ 720 if (tiling_format == VC4_TILING_FORMAT_T && 721 size_is_lt(level_width, level_height, cpp)) { 722 tiling_format = VC4_TILING_FORMAT_LT; 723 } 724 725 switch (tiling_format) { 726 case VC4_TILING_FORMAT_T: 727 aligned_width = round_up(level_width, utile_w * 8); 728 aligned_height = round_up(level_height, utile_h * 8); 729 break; 730 case VC4_TILING_FORMAT_LT: 731 aligned_width = round_up(level_width, utile_w); 732 aligned_height = round_up(level_height, utile_h); 733 break; 734 default: 735 aligned_width = round_up(level_width, utile_w); 736 aligned_height = level_height; 737 break; 738 } 739 740 level_size = aligned_width * cpp * aligned_height; 741 742 if (offset < level_size) { 743 DRM_DEBUG("Level %d (%dx%d -> %dx%d) size %db " 744 "overflowed buffer bounds (offset %d)\n", 745 i, level_width, level_height, 746 aligned_width, aligned_height, 747 level_size, offset); 748 goto fail; 749 } 750 751 offset -= level_size; 752 } 753 754 *validated_p0 = tex->dma_addr + p0; 755 756 return true; 757 fail: 758 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0); 759 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1); 760 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2); 761 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3); 762 return false; 763 } 764 765 static int 766 validate_gl_shader_rec(struct drm_device *dev, 767 struct vc4_exec_info *exec, 768 struct vc4_shader_state *state) 769 { 770 uint32_t *src_handles; 771 void *pkt_u, *pkt_v; 772 static const uint32_t shader_reloc_offsets[] = { 773 4, /* fs */ 774 16, /* vs */ 775 28, /* cs */ 776 }; 777 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets); 778 struct drm_gem_dma_object *bo[ARRAY_SIZE(shader_reloc_offsets) + 8]; 779 uint32_t nr_attributes, nr_relocs, packet_size; 780 int i; 781 782 nr_attributes = state->addr & 0x7; 783 if (nr_attributes == 0) 784 nr_attributes = 8; 785 packet_size = gl_shader_rec_size(state->addr); 786 787 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes; 788 if (nr_relocs * 4 > exec->shader_rec_size) { 789 DRM_DEBUG("overflowed shader recs reading %d handles " 790 "from %d bytes left\n", 791 nr_relocs, exec->shader_rec_size); 792 return -EINVAL; 793 } 794 src_handles = exec->shader_rec_u; 795 exec->shader_rec_u += nr_relocs * 4; 796 exec->shader_rec_size -= nr_relocs * 4; 797 798 if (packet_size > exec->shader_rec_size) { 799 DRM_DEBUG("overflowed shader recs copying %db packet " 800 "from %d bytes left\n", 801 packet_size, exec->shader_rec_size); 802 return -EINVAL; 803 } 804 pkt_u = exec->shader_rec_u; 805 pkt_v = exec->shader_rec_v; 806 memcpy(pkt_v, pkt_u, packet_size); 807 exec->shader_rec_u += packet_size; 808 /* Shader recs have to be aligned to 16 bytes (due to the attribute 809 * flags being in the low bytes), so round the next validated shader 810 * rec address up. This should be safe, since we've got so many 811 * relocations in a shader rec packet. 812 */ 813 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4); 814 exec->shader_rec_v += roundup(packet_size, 16); 815 exec->shader_rec_size -= packet_size; 816 817 for (i = 0; i < shader_reloc_count; i++) { 818 if (src_handles[i] > exec->bo_count) { 819 DRM_DEBUG("Shader handle %d too big\n", src_handles[i]); 820 return -EINVAL; 821 } 822 823 bo[i] = to_drm_gem_dma_obj(exec->bo[src_handles[i]]); 824 if (!bo[i]) 825 return -EINVAL; 826 } 827 for (i = shader_reloc_count; i < nr_relocs; i++) { 828 bo[i] = vc4_use_bo(exec, src_handles[i]); 829 if (!bo[i]) 830 return -EINVAL; 831 } 832 833 if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) != 834 to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) { 835 DRM_DEBUG("Thread mode of CL and FS do not match\n"); 836 return -EINVAL; 837 } 838 839 if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded || 840 to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) { 841 DRM_DEBUG("cs and vs cannot be threaded\n"); 842 return -EINVAL; 843 } 844 845 for (i = 0; i < shader_reloc_count; i++) { 846 struct vc4_validated_shader_info *validated_shader; 847 uint32_t o = shader_reloc_offsets[i]; 848 uint32_t src_offset = *(uint32_t *)(pkt_u + o); 849 uint32_t *texture_handles_u; 850 void *uniform_data_u; 851 uint32_t tex, uni; 852 853 *(uint32_t *)(pkt_v + o) = bo[i]->dma_addr + src_offset; 854 855 if (src_offset != 0) { 856 DRM_DEBUG("Shaders must be at offset 0 of " 857 "the BO.\n"); 858 return -EINVAL; 859 } 860 861 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader; 862 if (!validated_shader) 863 return -EINVAL; 864 865 if (validated_shader->uniforms_src_size > 866 exec->uniforms_size) { 867 DRM_DEBUG("Uniforms src buffer overflow\n"); 868 return -EINVAL; 869 } 870 871 texture_handles_u = exec->uniforms_u; 872 uniform_data_u = (texture_handles_u + 873 validated_shader->num_texture_samples); 874 875 memcpy(exec->uniforms_v, uniform_data_u, 876 validated_shader->uniforms_size); 877 878 for (tex = 0; 879 tex < validated_shader->num_texture_samples; 880 tex++) { 881 if (!reloc_tex(exec, 882 uniform_data_u, 883 &validated_shader->texture_samples[tex], 884 texture_handles_u[tex], 885 i == 2)) { 886 return -EINVAL; 887 } 888 } 889 890 /* Fill in the uniform slots that need this shader's 891 * start-of-uniforms address (used for resetting the uniform 892 * stream in the presence of control flow). 893 */ 894 for (uni = 0; 895 uni < validated_shader->num_uniform_addr_offsets; 896 uni++) { 897 uint32_t o = validated_shader->uniform_addr_offsets[uni]; 898 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p; 899 } 900 901 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p; 902 903 exec->uniforms_u += validated_shader->uniforms_src_size; 904 exec->uniforms_v += validated_shader->uniforms_size; 905 exec->uniforms_p += validated_shader->uniforms_size; 906 } 907 908 for (i = 0; i < nr_attributes; i++) { 909 struct drm_gem_dma_object *vbo = 910 bo[ARRAY_SIZE(shader_reloc_offsets) + i]; 911 uint32_t o = 36 + i * 8; 912 uint32_t offset = *(uint32_t *)(pkt_u + o + 0); 913 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1; 914 uint32_t stride = *(uint8_t *)(pkt_u + o + 5); 915 uint32_t max_index; 916 917 if (state->addr & 0x8) 918 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff; 919 920 if (vbo->base.size < offset || 921 vbo->base.size - offset < attr_size) { 922 DRM_DEBUG("BO offset overflow (%d + %d > %zu)\n", 923 offset, attr_size, vbo->base.size); 924 return -EINVAL; 925 } 926 927 if (stride != 0) { 928 max_index = ((vbo->base.size - offset - attr_size) / 929 stride); 930 if (state->max_index > max_index) { 931 DRM_DEBUG("primitives use index %d out of " 932 "supplied %d\n", 933 state->max_index, max_index); 934 return -EINVAL; 935 } 936 } 937 938 *(uint32_t *)(pkt_v + o) = vbo->dma_addr + offset; 939 } 940 941 return 0; 942 } 943 944 int 945 vc4_validate_shader_recs(struct drm_device *dev, 946 struct vc4_exec_info *exec) 947 { 948 struct vc4_dev *vc4 = to_vc4_dev(dev); 949 uint32_t i; 950 int ret = 0; 951 952 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4)) 953 return -ENODEV; 954 955 for (i = 0; i < exec->shader_state_count; i++) { 956 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]); 957 if (ret) 958 return ret; 959 } 960 961 return ret; 962 } 963