1 /*
2 * Copyright © 2014 Broadcom
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 */
23
24 /**
25 * DOC: Command list validator for VC4.
26 *
27 * Since the VC4 has no IOMMU between it and system memory, a user
28 * with access to execute command lists could escalate privilege by
29 * overwriting system memory (drawing to it as a framebuffer) or
30 * reading system memory it shouldn't (reading it as a vertex buffer
31 * or index buffer)
32 *
33 * We validate binner command lists to ensure that all accesses are
34 * within the bounds of the GEM objects referenced by the submitted
35 * job. It explicitly whitelists packets, and looks at the offsets in
36 * any address fields to make sure they're contained within the BOs
37 * they reference.
38 *
39 * Note that because CL validation is already reading the
40 * user-submitted CL and writing the validated copy out to the memory
41 * that the GPU will actually read, this is also where GEM relocation
42 * processing (turning BO references into actual addresses for the GPU
43 * to use) happens.
44 */
45
46 #include "uapi/drm/vc4_drm.h"
47 #include "vc4_drv.h"
48 #include "vc4_packet.h"
49
50 #define VALIDATE_ARGS \
51 struct vc4_exec_info *exec, \
52 void *validated, \
53 void *untrusted
54
55 /** Return the width in pixels of a 64-byte microtile. */
56 static uint32_t
utile_width(int cpp)57 utile_width(int cpp)
58 {
59 switch (cpp) {
60 case 1:
61 case 2:
62 return 8;
63 case 4:
64 return 4;
65 case 8:
66 return 2;
67 default:
68 pr_err("unknown cpp: %d\n", cpp);
69 return 1;
70 }
71 }
72
73 /** Return the height in pixels of a 64-byte microtile. */
74 static uint32_t
utile_height(int cpp)75 utile_height(int cpp)
76 {
77 switch (cpp) {
78 case 1:
79 return 8;
80 case 2:
81 case 4:
82 case 8:
83 return 4;
84 default:
85 pr_err("unknown cpp: %d\n", cpp);
86 return 1;
87 }
88 }
89
90 /**
91 * size_is_lt() - Returns whether a miplevel of the given size will
92 * use the lineartile (LT) tiling layout rather than the normal T
93 * tiling layout.
94 * @width: Width in pixels of the miplevel
95 * @height: Height in pixels of the miplevel
96 * @cpp: Bytes per pixel of the pixel format
97 */
98 static bool
size_is_lt(uint32_t width,uint32_t height,int cpp)99 size_is_lt(uint32_t width, uint32_t height, int cpp)
100 {
101 return (width <= 4 * utile_width(cpp) ||
102 height <= 4 * utile_height(cpp));
103 }
104
105 struct drm_gem_dma_object *
vc4_use_bo(struct vc4_exec_info * exec,uint32_t hindex)106 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex)
107 {
108 struct vc4_dev *vc4 = exec->dev;
109 struct drm_gem_dma_object *obj;
110 struct vc4_bo *bo;
111
112 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
113 return NULL;
114
115 if (hindex >= exec->bo_count) {
116 DRM_DEBUG("BO index %d greater than BO count %d\n",
117 hindex, exec->bo_count);
118 return NULL;
119 }
120 obj = to_drm_gem_dma_obj(exec->bo[hindex]);
121 bo = to_vc4_bo(&obj->base);
122
123 if (bo->validated_shader) {
124 DRM_DEBUG("Trying to use shader BO as something other than "
125 "a shader\n");
126 return NULL;
127 }
128
129 return obj;
130 }
131
132 static struct drm_gem_dma_object *
vc4_use_handle(struct vc4_exec_info * exec,uint32_t gem_handles_packet_index)133 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index)
134 {
135 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]);
136 }
137
138 static bool
validate_bin_pos(struct vc4_exec_info * exec,void * untrusted,uint32_t pos)139 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos)
140 {
141 /* Note that the untrusted pointer passed to these functions is
142 * incremented past the packet byte.
143 */
144 return (untrusted - 1 == exec->bin_u + pos);
145 }
146
147 static uint32_t
gl_shader_rec_size(uint32_t pointer_bits)148 gl_shader_rec_size(uint32_t pointer_bits)
149 {
150 uint32_t attribute_count = pointer_bits & 7;
151 bool extended = pointer_bits & 8;
152
153 if (attribute_count == 0)
154 attribute_count = 8;
155
156 if (extended)
157 return 100 + attribute_count * 4;
158 else
159 return 36 + attribute_count * 8;
160 }
161
162 bool
vc4_check_tex_size(struct vc4_exec_info * exec,struct drm_gem_dma_object * fbo,uint32_t offset,uint8_t tiling_format,uint32_t width,uint32_t height,uint8_t cpp)163 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_dma_object *fbo,
164 uint32_t offset, uint8_t tiling_format,
165 uint32_t width, uint32_t height, uint8_t cpp)
166 {
167 struct vc4_dev *vc4 = exec->dev;
168 uint32_t aligned_width, aligned_height, stride, size;
169 uint32_t utile_w = utile_width(cpp);
170 uint32_t utile_h = utile_height(cpp);
171
172 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
173 return false;
174
175 /* The shaded vertex format stores signed 12.4 fixed point
176 * (-2048,2047) offsets from the viewport center, so we should
177 * never have a render target larger than 4096. The texture
178 * unit can only sample from 2048x2048, so it's even more
179 * restricted. This lets us avoid worrying about overflow in
180 * our math.
181 */
182 if (width > 4096 || height > 4096) {
183 DRM_DEBUG("Surface dimensions (%d,%d) too large",
184 width, height);
185 return false;
186 }
187
188 switch (tiling_format) {
189 case VC4_TILING_FORMAT_LINEAR:
190 aligned_width = round_up(width, utile_w);
191 aligned_height = height;
192 break;
193 case VC4_TILING_FORMAT_T:
194 aligned_width = round_up(width, utile_w * 8);
195 aligned_height = round_up(height, utile_h * 8);
196 break;
197 case VC4_TILING_FORMAT_LT:
198 aligned_width = round_up(width, utile_w);
199 aligned_height = round_up(height, utile_h);
200 break;
201 default:
202 DRM_DEBUG("buffer tiling %d unsupported\n", tiling_format);
203 return false;
204 }
205
206 stride = aligned_width * cpp;
207 size = stride * aligned_height;
208
209 if (size + offset < size ||
210 size + offset > fbo->base.size) {
211 DRM_DEBUG("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n",
212 width, height,
213 aligned_width, aligned_height,
214 size, offset, fbo->base.size);
215 return false;
216 }
217
218 return true;
219 }
220
221 static int
validate_flush(VALIDATE_ARGS)222 validate_flush(VALIDATE_ARGS)
223 {
224 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) {
225 DRM_DEBUG("Bin CL must end with VC4_PACKET_FLUSH\n");
226 return -EINVAL;
227 }
228 exec->found_flush = true;
229
230 return 0;
231 }
232
233 static int
validate_start_tile_binning(VALIDATE_ARGS)234 validate_start_tile_binning(VALIDATE_ARGS)
235 {
236 if (exec->found_start_tile_binning_packet) {
237 DRM_DEBUG("Duplicate VC4_PACKET_START_TILE_BINNING\n");
238 return -EINVAL;
239 }
240 exec->found_start_tile_binning_packet = true;
241
242 if (!exec->found_tile_binning_mode_config_packet) {
243 DRM_DEBUG("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
244 return -EINVAL;
245 }
246
247 return 0;
248 }
249
250 static int
validate_increment_semaphore(VALIDATE_ARGS)251 validate_increment_semaphore(VALIDATE_ARGS)
252 {
253 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) {
254 DRM_DEBUG("Bin CL must end with "
255 "VC4_PACKET_INCREMENT_SEMAPHORE\n");
256 return -EINVAL;
257 }
258 exec->found_increment_semaphore_packet = true;
259
260 return 0;
261 }
262
263 static int
validate_indexed_prim_list(VALIDATE_ARGS)264 validate_indexed_prim_list(VALIDATE_ARGS)
265 {
266 struct drm_gem_dma_object *ib;
267 uint32_t length = *(uint32_t *)(untrusted + 1);
268 uint32_t offset = *(uint32_t *)(untrusted + 5);
269 uint32_t max_index = *(uint32_t *)(untrusted + 9);
270 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1;
271 struct vc4_shader_state *shader_state;
272
273 /* Check overflow condition */
274 if (exec->shader_state_count == 0) {
275 DRM_DEBUG("shader state must precede primitives\n");
276 return -EINVAL;
277 }
278 shader_state = &exec->shader_state[exec->shader_state_count - 1];
279
280 if (max_index > shader_state->max_index)
281 shader_state->max_index = max_index;
282
283 ib = vc4_use_handle(exec, 0);
284 if (!ib)
285 return -EINVAL;
286
287 if (offset > ib->base.size ||
288 (ib->base.size - offset) / index_size < length) {
289 DRM_DEBUG("IB access overflow (%d + %d*%d > %zd)\n",
290 offset, length, index_size, ib->base.size);
291 return -EINVAL;
292 }
293
294 *(uint32_t *)(validated + 5) = ib->dma_addr + offset;
295
296 return 0;
297 }
298
299 static int
validate_gl_array_primitive(VALIDATE_ARGS)300 validate_gl_array_primitive(VALIDATE_ARGS)
301 {
302 uint32_t length = *(uint32_t *)(untrusted + 1);
303 uint32_t base_index = *(uint32_t *)(untrusted + 5);
304 uint32_t max_index;
305 struct vc4_shader_state *shader_state;
306
307 /* Check overflow condition */
308 if (exec->shader_state_count == 0) {
309 DRM_DEBUG("shader state must precede primitives\n");
310 return -EINVAL;
311 }
312 shader_state = &exec->shader_state[exec->shader_state_count - 1];
313
314 if (length + base_index < length) {
315 DRM_DEBUG("primitive vertex count overflow\n");
316 return -EINVAL;
317 }
318 max_index = length + base_index - 1;
319
320 if (max_index > shader_state->max_index)
321 shader_state->max_index = max_index;
322
323 return 0;
324 }
325
326 static int
validate_gl_shader_state(VALIDATE_ARGS)327 validate_gl_shader_state(VALIDATE_ARGS)
328 {
329 uint32_t i = exec->shader_state_count++;
330
331 if (i >= exec->shader_state_size) {
332 DRM_DEBUG("More requests for shader states than declared\n");
333 return -EINVAL;
334 }
335
336 exec->shader_state[i].addr = *(uint32_t *)untrusted;
337 exec->shader_state[i].max_index = 0;
338
339 if (exec->shader_state[i].addr & ~0xf) {
340 DRM_DEBUG("high bits set in GL shader rec reference\n");
341 return -EINVAL;
342 }
343
344 *(uint32_t *)validated = (exec->shader_rec_p +
345 exec->shader_state[i].addr);
346
347 exec->shader_rec_p +=
348 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16);
349
350 return 0;
351 }
352
353 static int
validate_tile_binning_config(VALIDATE_ARGS)354 validate_tile_binning_config(VALIDATE_ARGS)
355 {
356 struct drm_device *dev = exec->exec_bo->base.dev;
357 struct vc4_dev *vc4 = to_vc4_dev(dev);
358 uint8_t flags;
359 uint32_t tile_state_size;
360 uint32_t tile_count, bin_addr;
361 int bin_slot;
362
363 if (exec->found_tile_binning_mode_config_packet) {
364 DRM_DEBUG("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n");
365 return -EINVAL;
366 }
367 exec->found_tile_binning_mode_config_packet = true;
368
369 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12);
370 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13);
371 tile_count = exec->bin_tiles_x * exec->bin_tiles_y;
372 flags = *(uint8_t *)(untrusted + 14);
373
374 if (exec->bin_tiles_x == 0 ||
375 exec->bin_tiles_y == 0) {
376 DRM_DEBUG("Tile binning config of %dx%d too small\n",
377 exec->bin_tiles_x, exec->bin_tiles_y);
378 return -EINVAL;
379 }
380
381 if (flags & (VC4_BIN_CONFIG_DB_NON_MS |
382 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) {
383 DRM_DEBUG("unsupported binning config flags 0x%02x\n", flags);
384 return -EINVAL;
385 }
386
387 bin_slot = vc4_v3d_get_bin_slot(vc4);
388 if (bin_slot < 0) {
389 if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) {
390 drm_err(dev, "Failed to allocate binner memory: %d\n",
391 bin_slot);
392 }
393 return bin_slot;
394 }
395
396 /* The slot we allocated will only be used by this job, and is
397 * free when the job completes rendering.
398 */
399 exec->bin_slots |= BIT(bin_slot);
400 bin_addr = vc4->bin_bo->base.dma_addr + bin_slot * vc4->bin_alloc_size;
401
402 /* The tile state data array is 48 bytes per tile, and we put it at
403 * the start of a BO containing both it and the tile alloc.
404 */
405 tile_state_size = 48 * tile_count;
406
407 /* Since the tile alloc array will follow us, align. */
408 exec->tile_alloc_offset = bin_addr + roundup(tile_state_size, 4096);
409
410 *(uint8_t *)(validated + 14) =
411 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK |
412 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) |
413 VC4_BIN_CONFIG_AUTO_INIT_TSDA |
414 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32,
415 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) |
416 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128,
417 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE));
418
419 /* tile alloc address. */
420 *(uint32_t *)(validated + 0) = exec->tile_alloc_offset;
421 /* tile alloc size. */
422 *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size -
423 exec->tile_alloc_offset);
424 /* tile state address. */
425 *(uint32_t *)(validated + 8) = bin_addr;
426
427 return 0;
428 }
429
430 static int
validate_gem_handles(VALIDATE_ARGS)431 validate_gem_handles(VALIDATE_ARGS)
432 {
433 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index));
434 return 0;
435 }
436
437 #define VC4_DEFINE_PACKET(packet, func) \
438 [packet] = { packet ## _SIZE, #packet, func }
439
440 static const struct cmd_info {
441 uint16_t len;
442 const char *name;
443 int (*func)(struct vc4_exec_info *exec, void *validated,
444 void *untrusted);
445 } cmd_info[] = {
446 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL),
447 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL),
448 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush),
449 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL),
450 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING,
451 validate_start_tile_binning),
452 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE,
453 validate_increment_semaphore),
454
455 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE,
456 validate_indexed_prim_list),
457 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE,
458 validate_gl_array_primitive),
459
460 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL),
461
462 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state),
463
464 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL),
465 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL),
466 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL),
467 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL),
468 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL),
469 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL),
470 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL),
471 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL),
472 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL),
473 /* Note: The docs say this was also 105, but it was 106 in the
474 * initial userland code drop.
475 */
476 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL),
477
478 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG,
479 validate_tile_binning_config),
480
481 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles),
482 };
483
484 int
vc4_validate_bin_cl(struct drm_device * dev,void * validated,void * unvalidated,struct vc4_exec_info * exec)485 vc4_validate_bin_cl(struct drm_device *dev,
486 void *validated,
487 void *unvalidated,
488 struct vc4_exec_info *exec)
489 {
490 struct vc4_dev *vc4 = to_vc4_dev(dev);
491 uint32_t len = exec->args->bin_cl_size;
492 uint32_t dst_offset = 0;
493 uint32_t src_offset = 0;
494
495 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
496 return -ENODEV;
497
498 while (src_offset < len) {
499 void *dst_pkt = validated + dst_offset;
500 void *src_pkt = unvalidated + src_offset;
501 u8 cmd = *(uint8_t *)src_pkt;
502 const struct cmd_info *info;
503
504 if (cmd >= ARRAY_SIZE(cmd_info)) {
505 DRM_DEBUG("0x%08x: packet %d out of bounds\n",
506 src_offset, cmd);
507 return -EINVAL;
508 }
509
510 info = &cmd_info[cmd];
511 if (!info->name) {
512 DRM_DEBUG("0x%08x: packet %d invalid\n",
513 src_offset, cmd);
514 return -EINVAL;
515 }
516
517 if (src_offset + info->len > len) {
518 DRM_DEBUG("0x%08x: packet %d (%s) length 0x%08x "
519 "exceeds bounds (0x%08x)\n",
520 src_offset, cmd, info->name, info->len,
521 src_offset + len);
522 return -EINVAL;
523 }
524
525 if (cmd != VC4_PACKET_GEM_HANDLES)
526 memcpy(dst_pkt, src_pkt, info->len);
527
528 if (info->func && info->func(exec,
529 dst_pkt + 1,
530 src_pkt + 1)) {
531 DRM_DEBUG("0x%08x: packet %d (%s) failed to validate\n",
532 src_offset, cmd, info->name);
533 return -EINVAL;
534 }
535
536 src_offset += info->len;
537 /* GEM handle loading doesn't produce HW packets. */
538 if (cmd != VC4_PACKET_GEM_HANDLES)
539 dst_offset += info->len;
540
541 /* When the CL hits halt, it'll stop reading anything else. */
542 if (cmd == VC4_PACKET_HALT)
543 break;
544 }
545
546 exec->ct0ea = exec->ct0ca + dst_offset;
547
548 if (!exec->found_start_tile_binning_packet) {
549 DRM_DEBUG("Bin CL missing VC4_PACKET_START_TILE_BINNING\n");
550 return -EINVAL;
551 }
552
553 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The
554 * semaphore is used to trigger the render CL to start up, and the
555 * FLUSH is what caps the bin lists with
556 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main
557 * render CL when they get called to) and actually triggers the queued
558 * semaphore increment.
559 */
560 if (!exec->found_increment_semaphore_packet || !exec->found_flush) {
561 DRM_DEBUG("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + "
562 "VC4_PACKET_FLUSH\n");
563 return -EINVAL;
564 }
565
566 return 0;
567 }
568
569 static bool
reloc_tex(struct vc4_exec_info * exec,void * uniform_data_u,struct vc4_texture_sample_info * sample,uint32_t texture_handle_index,bool is_cs)570 reloc_tex(struct vc4_exec_info *exec,
571 void *uniform_data_u,
572 struct vc4_texture_sample_info *sample,
573 uint32_t texture_handle_index, bool is_cs)
574 {
575 struct drm_gem_dma_object *tex;
576 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
577 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]);
578 uint32_t p2 = (sample->p_offset[2] != ~0 ?
579 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0);
580 uint32_t p3 = (sample->p_offset[3] != ~0 ?
581 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0);
582 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0];
583 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK;
584 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS);
585 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH);
586 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT);
587 uint32_t cpp, tiling_format, utile_w, utile_h;
588 uint32_t i;
589 uint32_t cube_map_stride = 0;
590 enum vc4_texture_data_type type;
591
592 tex = vc4_use_bo(exec, texture_handle_index);
593 if (!tex)
594 return false;
595
596 if (sample->is_direct) {
597 uint32_t remaining_size = tex->base.size - p0;
598
599 if (p0 > tex->base.size - 4) {
600 DRM_DEBUG("UBO offset greater than UBO size\n");
601 goto fail;
602 }
603 if (p1 > remaining_size - 4) {
604 DRM_DEBUG("UBO clamp would allow reads "
605 "outside of UBO\n");
606 goto fail;
607 }
608 *validated_p0 = tex->dma_addr + p0;
609 return true;
610 }
611
612 if (width == 0)
613 width = 2048;
614 if (height == 0)
615 height = 2048;
616
617 if (p0 & VC4_TEX_P0_CMMODE_MASK) {
618 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) ==
619 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE)
620 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK;
621 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) ==
622 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) {
623 if (cube_map_stride) {
624 DRM_DEBUG("Cube map stride set twice\n");
625 goto fail;
626 }
627
628 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK;
629 }
630 if (!cube_map_stride) {
631 DRM_DEBUG("Cube map stride not set\n");
632 goto fail;
633 }
634 }
635
636 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) |
637 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4));
638
639 switch (type) {
640 case VC4_TEXTURE_TYPE_RGBA8888:
641 case VC4_TEXTURE_TYPE_RGBX8888:
642 case VC4_TEXTURE_TYPE_RGBA32R:
643 cpp = 4;
644 break;
645 case VC4_TEXTURE_TYPE_RGBA4444:
646 case VC4_TEXTURE_TYPE_RGBA5551:
647 case VC4_TEXTURE_TYPE_RGB565:
648 case VC4_TEXTURE_TYPE_LUMALPHA:
649 case VC4_TEXTURE_TYPE_S16F:
650 case VC4_TEXTURE_TYPE_S16:
651 cpp = 2;
652 break;
653 case VC4_TEXTURE_TYPE_LUMINANCE:
654 case VC4_TEXTURE_TYPE_ALPHA:
655 case VC4_TEXTURE_TYPE_S8:
656 cpp = 1;
657 break;
658 case VC4_TEXTURE_TYPE_ETC1:
659 /* ETC1 is arranged as 64-bit blocks, where each block is 4x4
660 * pixels.
661 */
662 cpp = 8;
663 width = (width + 3) >> 2;
664 height = (height + 3) >> 2;
665 break;
666 case VC4_TEXTURE_TYPE_BW1:
667 case VC4_TEXTURE_TYPE_A4:
668 case VC4_TEXTURE_TYPE_A1:
669 case VC4_TEXTURE_TYPE_RGBA64:
670 case VC4_TEXTURE_TYPE_YUV422R:
671 default:
672 DRM_DEBUG("Texture format %d unsupported\n", type);
673 goto fail;
674 }
675 utile_w = utile_width(cpp);
676 utile_h = utile_height(cpp);
677
678 if (type == VC4_TEXTURE_TYPE_RGBA32R) {
679 tiling_format = VC4_TILING_FORMAT_LINEAR;
680 } else {
681 if (size_is_lt(width, height, cpp))
682 tiling_format = VC4_TILING_FORMAT_LT;
683 else
684 tiling_format = VC4_TILING_FORMAT_T;
685 }
686
687 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5,
688 tiling_format, width, height, cpp)) {
689 goto fail;
690 }
691
692 /* The mipmap levels are stored before the base of the texture. Make
693 * sure there is actually space in the BO.
694 */
695 for (i = 1; i <= miplevels; i++) {
696 uint32_t level_width = max(width >> i, 1u);
697 uint32_t level_height = max(height >> i, 1u);
698 uint32_t aligned_width, aligned_height;
699 uint32_t level_size;
700
701 /* Once the levels get small enough, they drop from T to LT. */
702 if (tiling_format == VC4_TILING_FORMAT_T &&
703 size_is_lt(level_width, level_height, cpp)) {
704 tiling_format = VC4_TILING_FORMAT_LT;
705 }
706
707 switch (tiling_format) {
708 case VC4_TILING_FORMAT_T:
709 aligned_width = round_up(level_width, utile_w * 8);
710 aligned_height = round_up(level_height, utile_h * 8);
711 break;
712 case VC4_TILING_FORMAT_LT:
713 aligned_width = round_up(level_width, utile_w);
714 aligned_height = round_up(level_height, utile_h);
715 break;
716 default:
717 aligned_width = round_up(level_width, utile_w);
718 aligned_height = level_height;
719 break;
720 }
721
722 level_size = aligned_width * cpp * aligned_height;
723
724 if (offset < level_size) {
725 DRM_DEBUG("Level %d (%dx%d -> %dx%d) size %db "
726 "overflowed buffer bounds (offset %d)\n",
727 i, level_width, level_height,
728 aligned_width, aligned_height,
729 level_size, offset);
730 goto fail;
731 }
732
733 offset -= level_size;
734 }
735
736 *validated_p0 = tex->dma_addr + p0;
737
738 return true;
739 fail:
740 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
741 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1);
742 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2);
743 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3);
744 return false;
745 }
746
747 static int
validate_gl_shader_rec(struct drm_device * dev,struct vc4_exec_info * exec,struct vc4_shader_state * state)748 validate_gl_shader_rec(struct drm_device *dev,
749 struct vc4_exec_info *exec,
750 struct vc4_shader_state *state)
751 {
752 uint32_t *src_handles;
753 void *pkt_u, *pkt_v;
754 static const uint32_t shader_reloc_offsets[] = {
755 4, /* fs */
756 16, /* vs */
757 28, /* cs */
758 };
759 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets);
760 struct drm_gem_dma_object *bo[ARRAY_SIZE(shader_reloc_offsets) + 8];
761 uint32_t nr_attributes, nr_relocs, packet_size;
762 int i;
763
764 nr_attributes = state->addr & 0x7;
765 if (nr_attributes == 0)
766 nr_attributes = 8;
767 packet_size = gl_shader_rec_size(state->addr);
768
769 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes;
770 if (nr_relocs * 4 > exec->shader_rec_size) {
771 DRM_DEBUG("overflowed shader recs reading %d handles "
772 "from %d bytes left\n",
773 nr_relocs, exec->shader_rec_size);
774 return -EINVAL;
775 }
776 src_handles = exec->shader_rec_u;
777 exec->shader_rec_u += nr_relocs * 4;
778 exec->shader_rec_size -= nr_relocs * 4;
779
780 if (packet_size > exec->shader_rec_size) {
781 DRM_DEBUG("overflowed shader recs copying %db packet "
782 "from %d bytes left\n",
783 packet_size, exec->shader_rec_size);
784 return -EINVAL;
785 }
786 pkt_u = exec->shader_rec_u;
787 pkt_v = exec->shader_rec_v;
788 memcpy(pkt_v, pkt_u, packet_size);
789 exec->shader_rec_u += packet_size;
790 /* Shader recs have to be aligned to 16 bytes (due to the attribute
791 * flags being in the low bytes), so round the next validated shader
792 * rec address up. This should be safe, since we've got so many
793 * relocations in a shader rec packet.
794 */
795 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4);
796 exec->shader_rec_v += roundup(packet_size, 16);
797 exec->shader_rec_size -= packet_size;
798
799 for (i = 0; i < shader_reloc_count; i++) {
800 if (src_handles[i] > exec->bo_count) {
801 DRM_DEBUG("Shader handle %d too big\n", src_handles[i]);
802 return -EINVAL;
803 }
804
805 bo[i] = to_drm_gem_dma_obj(exec->bo[src_handles[i]]);
806 if (!bo[i])
807 return -EINVAL;
808 }
809 for (i = shader_reloc_count; i < nr_relocs; i++) {
810 bo[i] = vc4_use_bo(exec, src_handles[i]);
811 if (!bo[i])
812 return -EINVAL;
813 }
814
815 if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) !=
816 to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) {
817 DRM_DEBUG("Thread mode of CL and FS do not match\n");
818 return -EINVAL;
819 }
820
821 if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded ||
822 to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) {
823 DRM_DEBUG("cs and vs cannot be threaded\n");
824 return -EINVAL;
825 }
826
827 for (i = 0; i < shader_reloc_count; i++) {
828 struct vc4_validated_shader_info *validated_shader;
829 uint32_t o = shader_reloc_offsets[i];
830 uint32_t src_offset = *(uint32_t *)(pkt_u + o);
831 uint32_t *texture_handles_u;
832 void *uniform_data_u;
833 uint32_t tex, uni;
834
835 *(uint32_t *)(pkt_v + o) = bo[i]->dma_addr + src_offset;
836
837 if (src_offset != 0) {
838 DRM_DEBUG("Shaders must be at offset 0 of "
839 "the BO.\n");
840 return -EINVAL;
841 }
842
843 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader;
844 if (!validated_shader)
845 return -EINVAL;
846
847 if (validated_shader->uniforms_src_size >
848 exec->uniforms_size) {
849 DRM_DEBUG("Uniforms src buffer overflow\n");
850 return -EINVAL;
851 }
852
853 texture_handles_u = exec->uniforms_u;
854 uniform_data_u = (texture_handles_u +
855 validated_shader->num_texture_samples);
856
857 memcpy(exec->uniforms_v, uniform_data_u,
858 validated_shader->uniforms_size);
859
860 for (tex = 0;
861 tex < validated_shader->num_texture_samples;
862 tex++) {
863 if (!reloc_tex(exec,
864 uniform_data_u,
865 &validated_shader->texture_samples[tex],
866 texture_handles_u[tex],
867 i == 2)) {
868 return -EINVAL;
869 }
870 }
871
872 /* Fill in the uniform slots that need this shader's
873 * start-of-uniforms address (used for resetting the uniform
874 * stream in the presence of control flow).
875 */
876 for (uni = 0;
877 uni < validated_shader->num_uniform_addr_offsets;
878 uni++) {
879 uint32_t o = validated_shader->uniform_addr_offsets[uni];
880 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p;
881 }
882
883 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p;
884
885 exec->uniforms_u += validated_shader->uniforms_src_size;
886 exec->uniforms_v += validated_shader->uniforms_size;
887 exec->uniforms_p += validated_shader->uniforms_size;
888 }
889
890 for (i = 0; i < nr_attributes; i++) {
891 struct drm_gem_dma_object *vbo =
892 bo[ARRAY_SIZE(shader_reloc_offsets) + i];
893 uint32_t o = 36 + i * 8;
894 uint32_t offset = *(uint32_t *)(pkt_u + o + 0);
895 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1;
896 uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
897 uint32_t max_index;
898
899 if (state->addr & 0x8)
900 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
901
902 if (vbo->base.size < offset ||
903 vbo->base.size - offset < attr_size) {
904 DRM_DEBUG("BO offset overflow (%d + %d > %zu)\n",
905 offset, attr_size, vbo->base.size);
906 return -EINVAL;
907 }
908
909 if (stride != 0) {
910 max_index = ((vbo->base.size - offset - attr_size) /
911 stride);
912 if (state->max_index > max_index) {
913 DRM_DEBUG("primitives use index %d out of "
914 "supplied %d\n",
915 state->max_index, max_index);
916 return -EINVAL;
917 }
918 }
919
920 *(uint32_t *)(pkt_v + o) = vbo->dma_addr + offset;
921 }
922
923 return 0;
924 }
925
926 int
vc4_validate_shader_recs(struct drm_device * dev,struct vc4_exec_info * exec)927 vc4_validate_shader_recs(struct drm_device *dev,
928 struct vc4_exec_info *exec)
929 {
930 struct vc4_dev *vc4 = to_vc4_dev(dev);
931 uint32_t i;
932 int ret = 0;
933
934 if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
935 return -ENODEV;
936
937 for (i = 0; i < exec->shader_state_count; i++) {
938 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]);
939 if (ret)
940 return ret;
941 }
942
943 return ret;
944 }
945