1 /* 2 * Copyright © 2014 Broadcom 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 */ 23 24 /** 25 * DOC: Command list validator for VC4. 26 * 27 * Since the VC4 has no IOMMU between it and system memory, a user 28 * with access to execute command lists could escalate privilege by 29 * overwriting system memory (drawing to it as a framebuffer) or 30 * reading system memory it shouldn't (reading it as a vertex buffer 31 * or index buffer) 32 * 33 * We validate binner command lists to ensure that all accesses are 34 * within the bounds of the GEM objects referenced by the submitted 35 * job. It explicitly whitelists packets, and looks at the offsets in 36 * any address fields to make sure they're contained within the BOs 37 * they reference. 38 * 39 * Note that because CL validation is already reading the 40 * user-submitted CL and writing the validated copy out to the memory 41 * that the GPU will actually read, this is also where GEM relocation 42 * processing (turning BO references into actual addresses for the GPU 43 * to use) happens. 44 */ 45 46 #include "uapi/drm/vc4_drm.h" 47 #include "vc4_drv.h" 48 #include "vc4_packet.h" 49 50 #define VALIDATE_ARGS \ 51 struct vc4_exec_info *exec, \ 52 void *validated, \ 53 void *untrusted 54 55 /** Return the width in pixels of a 64-byte microtile. */ 56 static uint32_t 57 utile_width(int cpp) 58 { 59 switch (cpp) { 60 case 1: 61 case 2: 62 return 8; 63 case 4: 64 return 4; 65 case 8: 66 return 2; 67 default: 68 DRM_ERROR("unknown cpp: %d\n", cpp); 69 return 1; 70 } 71 } 72 73 /** Return the height in pixels of a 64-byte microtile. */ 74 static uint32_t 75 utile_height(int cpp) 76 { 77 switch (cpp) { 78 case 1: 79 return 8; 80 case 2: 81 case 4: 82 case 8: 83 return 4; 84 default: 85 DRM_ERROR("unknown cpp: %d\n", cpp); 86 return 1; 87 } 88 } 89 90 /** 91 * size_is_lt() - Returns whether a miplevel of the given size will 92 * use the lineartile (LT) tiling layout rather than the normal T 93 * tiling layout. 94 * @width: Width in pixels of the miplevel 95 * @height: Height in pixels of the miplevel 96 * @cpp: Bytes per pixel of the pixel format 97 */ 98 static bool 99 size_is_lt(uint32_t width, uint32_t height, int cpp) 100 { 101 return (width <= 4 * utile_width(cpp) || 102 height <= 4 * utile_height(cpp)); 103 } 104 105 struct drm_gem_dma_object * 106 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex) 107 { 108 struct vc4_dev *vc4 = exec->dev; 109 struct drm_gem_dma_object *obj; 110 struct vc4_bo *bo; 111 112 if (WARN_ON_ONCE(vc4->is_vc5)) 113 return NULL; 114 115 if (hindex >= exec->bo_count) { 116 DRM_DEBUG("BO index %d greater than BO count %d\n", 117 hindex, exec->bo_count); 118 return NULL; 119 } 120 obj = exec->bo[hindex]; 121 bo = to_vc4_bo(&obj->base); 122 123 if (bo->validated_shader) { 124 DRM_DEBUG("Trying to use shader BO as something other than " 125 "a shader\n"); 126 return NULL; 127 } 128 129 return obj; 130 } 131 132 static struct drm_gem_dma_object * 133 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index) 134 { 135 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]); 136 } 137 138 static bool 139 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos) 140 { 141 /* Note that the untrusted pointer passed to these functions is 142 * incremented past the packet byte. 143 */ 144 return (untrusted - 1 == exec->bin_u + pos); 145 } 146 147 static uint32_t 148 gl_shader_rec_size(uint32_t pointer_bits) 149 { 150 uint32_t attribute_count = pointer_bits & 7; 151 bool extended = pointer_bits & 8; 152 153 if (attribute_count == 0) 154 attribute_count = 8; 155 156 if (extended) 157 return 100 + attribute_count * 4; 158 else 159 return 36 + attribute_count * 8; 160 } 161 162 bool 163 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_dma_object *fbo, 164 uint32_t offset, uint8_t tiling_format, 165 uint32_t width, uint32_t height, uint8_t cpp) 166 { 167 struct vc4_dev *vc4 = exec->dev; 168 uint32_t aligned_width, aligned_height, stride, size; 169 uint32_t utile_w = utile_width(cpp); 170 uint32_t utile_h = utile_height(cpp); 171 172 if (WARN_ON_ONCE(vc4->is_vc5)) 173 return false; 174 175 /* The shaded vertex format stores signed 12.4 fixed point 176 * (-2048,2047) offsets from the viewport center, so we should 177 * never have a render target larger than 4096. The texture 178 * unit can only sample from 2048x2048, so it's even more 179 * restricted. This lets us avoid worrying about overflow in 180 * our math. 181 */ 182 if (width > 4096 || height > 4096) { 183 DRM_DEBUG("Surface dimensions (%d,%d) too large", 184 width, height); 185 return false; 186 } 187 188 switch (tiling_format) { 189 case VC4_TILING_FORMAT_LINEAR: 190 aligned_width = round_up(width, utile_w); 191 aligned_height = height; 192 break; 193 case VC4_TILING_FORMAT_T: 194 aligned_width = round_up(width, utile_w * 8); 195 aligned_height = round_up(height, utile_h * 8); 196 break; 197 case VC4_TILING_FORMAT_LT: 198 aligned_width = round_up(width, utile_w); 199 aligned_height = round_up(height, utile_h); 200 break; 201 default: 202 DRM_DEBUG("buffer tiling %d unsupported\n", tiling_format); 203 return false; 204 } 205 206 stride = aligned_width * cpp; 207 size = stride * aligned_height; 208 209 if (size + offset < size || 210 size + offset > fbo->base.size) { 211 DRM_DEBUG("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n", 212 width, height, 213 aligned_width, aligned_height, 214 size, offset, fbo->base.size); 215 return false; 216 } 217 218 return true; 219 } 220 221 static int 222 validate_flush(VALIDATE_ARGS) 223 { 224 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) { 225 DRM_DEBUG("Bin CL must end with VC4_PACKET_FLUSH\n"); 226 return -EINVAL; 227 } 228 exec->found_flush = true; 229 230 return 0; 231 } 232 233 static int 234 validate_start_tile_binning(VALIDATE_ARGS) 235 { 236 if (exec->found_start_tile_binning_packet) { 237 DRM_DEBUG("Duplicate VC4_PACKET_START_TILE_BINNING\n"); 238 return -EINVAL; 239 } 240 exec->found_start_tile_binning_packet = true; 241 242 if (!exec->found_tile_binning_mode_config_packet) { 243 DRM_DEBUG("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 244 return -EINVAL; 245 } 246 247 return 0; 248 } 249 250 static int 251 validate_increment_semaphore(VALIDATE_ARGS) 252 { 253 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) { 254 DRM_DEBUG("Bin CL must end with " 255 "VC4_PACKET_INCREMENT_SEMAPHORE\n"); 256 return -EINVAL; 257 } 258 exec->found_increment_semaphore_packet = true; 259 260 return 0; 261 } 262 263 static int 264 validate_indexed_prim_list(VALIDATE_ARGS) 265 { 266 struct drm_gem_dma_object *ib; 267 uint32_t length = *(uint32_t *)(untrusted + 1); 268 uint32_t offset = *(uint32_t *)(untrusted + 5); 269 uint32_t max_index = *(uint32_t *)(untrusted + 9); 270 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1; 271 struct vc4_shader_state *shader_state; 272 273 /* Check overflow condition */ 274 if (exec->shader_state_count == 0) { 275 DRM_DEBUG("shader state must precede primitives\n"); 276 return -EINVAL; 277 } 278 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 279 280 if (max_index > shader_state->max_index) 281 shader_state->max_index = max_index; 282 283 ib = vc4_use_handle(exec, 0); 284 if (!ib) 285 return -EINVAL; 286 287 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 288 to_vc4_bo(&ib->base)->write_seqno); 289 290 if (offset > ib->base.size || 291 (ib->base.size - offset) / index_size < length) { 292 DRM_DEBUG("IB access overflow (%d + %d*%d > %zd)\n", 293 offset, length, index_size, ib->base.size); 294 return -EINVAL; 295 } 296 297 *(uint32_t *)(validated + 5) = ib->dma_addr + offset; 298 299 return 0; 300 } 301 302 static int 303 validate_gl_array_primitive(VALIDATE_ARGS) 304 { 305 uint32_t length = *(uint32_t *)(untrusted + 1); 306 uint32_t base_index = *(uint32_t *)(untrusted + 5); 307 uint32_t max_index; 308 struct vc4_shader_state *shader_state; 309 310 /* Check overflow condition */ 311 if (exec->shader_state_count == 0) { 312 DRM_DEBUG("shader state must precede primitives\n"); 313 return -EINVAL; 314 } 315 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 316 317 if (length + base_index < length) { 318 DRM_DEBUG("primitive vertex count overflow\n"); 319 return -EINVAL; 320 } 321 max_index = length + base_index - 1; 322 323 if (max_index > shader_state->max_index) 324 shader_state->max_index = max_index; 325 326 return 0; 327 } 328 329 static int 330 validate_gl_shader_state(VALIDATE_ARGS) 331 { 332 uint32_t i = exec->shader_state_count++; 333 334 if (i >= exec->shader_state_size) { 335 DRM_DEBUG("More requests for shader states than declared\n"); 336 return -EINVAL; 337 } 338 339 exec->shader_state[i].addr = *(uint32_t *)untrusted; 340 exec->shader_state[i].max_index = 0; 341 342 if (exec->shader_state[i].addr & ~0xf) { 343 DRM_DEBUG("high bits set in GL shader rec reference\n"); 344 return -EINVAL; 345 } 346 347 *(uint32_t *)validated = (exec->shader_rec_p + 348 exec->shader_state[i].addr); 349 350 exec->shader_rec_p += 351 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16); 352 353 return 0; 354 } 355 356 static int 357 validate_tile_binning_config(VALIDATE_ARGS) 358 { 359 struct drm_device *dev = exec->exec_bo->base.dev; 360 struct vc4_dev *vc4 = to_vc4_dev(dev); 361 uint8_t flags; 362 uint32_t tile_state_size; 363 uint32_t tile_count, bin_addr; 364 int bin_slot; 365 366 if (exec->found_tile_binning_mode_config_packet) { 367 DRM_DEBUG("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 368 return -EINVAL; 369 } 370 exec->found_tile_binning_mode_config_packet = true; 371 372 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12); 373 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13); 374 tile_count = exec->bin_tiles_x * exec->bin_tiles_y; 375 flags = *(uint8_t *)(untrusted + 14); 376 377 if (exec->bin_tiles_x == 0 || 378 exec->bin_tiles_y == 0) { 379 DRM_DEBUG("Tile binning config of %dx%d too small\n", 380 exec->bin_tiles_x, exec->bin_tiles_y); 381 return -EINVAL; 382 } 383 384 if (flags & (VC4_BIN_CONFIG_DB_NON_MS | 385 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) { 386 DRM_DEBUG("unsupported binning config flags 0x%02x\n", flags); 387 return -EINVAL; 388 } 389 390 bin_slot = vc4_v3d_get_bin_slot(vc4); 391 if (bin_slot < 0) { 392 if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) { 393 DRM_ERROR("Failed to allocate binner memory: %d\n", 394 bin_slot); 395 } 396 return bin_slot; 397 } 398 399 /* The slot we allocated will only be used by this job, and is 400 * free when the job completes rendering. 401 */ 402 exec->bin_slots |= BIT(bin_slot); 403 bin_addr = vc4->bin_bo->base.dma_addr + bin_slot * vc4->bin_alloc_size; 404 405 /* The tile state data array is 48 bytes per tile, and we put it at 406 * the start of a BO containing both it and the tile alloc. 407 */ 408 tile_state_size = 48 * tile_count; 409 410 /* Since the tile alloc array will follow us, align. */ 411 exec->tile_alloc_offset = bin_addr + roundup(tile_state_size, 4096); 412 413 *(uint8_t *)(validated + 14) = 414 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK | 415 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) | 416 VC4_BIN_CONFIG_AUTO_INIT_TSDA | 417 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32, 418 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) | 419 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128, 420 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE)); 421 422 /* tile alloc address. */ 423 *(uint32_t *)(validated + 0) = exec->tile_alloc_offset; 424 /* tile alloc size. */ 425 *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size - 426 exec->tile_alloc_offset); 427 /* tile state address. */ 428 *(uint32_t *)(validated + 8) = bin_addr; 429 430 return 0; 431 } 432 433 static int 434 validate_gem_handles(VALIDATE_ARGS) 435 { 436 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index)); 437 return 0; 438 } 439 440 #define VC4_DEFINE_PACKET(packet, func) \ 441 [packet] = { packet ## _SIZE, #packet, func } 442 443 static const struct cmd_info { 444 uint16_t len; 445 const char *name; 446 int (*func)(struct vc4_exec_info *exec, void *validated, 447 void *untrusted); 448 } cmd_info[] = { 449 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL), 450 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL), 451 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush), 452 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL), 453 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING, 454 validate_start_tile_binning), 455 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE, 456 validate_increment_semaphore), 457 458 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE, 459 validate_indexed_prim_list), 460 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE, 461 validate_gl_array_primitive), 462 463 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL), 464 465 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state), 466 467 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL), 468 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL), 469 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL), 470 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL), 471 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL), 472 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL), 473 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL), 474 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL), 475 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL), 476 /* Note: The docs say this was also 105, but it was 106 in the 477 * initial userland code drop. 478 */ 479 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL), 480 481 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG, 482 validate_tile_binning_config), 483 484 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles), 485 }; 486 487 int 488 vc4_validate_bin_cl(struct drm_device *dev, 489 void *validated, 490 void *unvalidated, 491 struct vc4_exec_info *exec) 492 { 493 struct vc4_dev *vc4 = to_vc4_dev(dev); 494 uint32_t len = exec->args->bin_cl_size; 495 uint32_t dst_offset = 0; 496 uint32_t src_offset = 0; 497 498 if (WARN_ON_ONCE(vc4->is_vc5)) 499 return -ENODEV; 500 501 while (src_offset < len) { 502 void *dst_pkt = validated + dst_offset; 503 void *src_pkt = unvalidated + src_offset; 504 u8 cmd = *(uint8_t *)src_pkt; 505 const struct cmd_info *info; 506 507 if (cmd >= ARRAY_SIZE(cmd_info)) { 508 DRM_DEBUG("0x%08x: packet %d out of bounds\n", 509 src_offset, cmd); 510 return -EINVAL; 511 } 512 513 info = &cmd_info[cmd]; 514 if (!info->name) { 515 DRM_DEBUG("0x%08x: packet %d invalid\n", 516 src_offset, cmd); 517 return -EINVAL; 518 } 519 520 if (src_offset + info->len > len) { 521 DRM_DEBUG("0x%08x: packet %d (%s) length 0x%08x " 522 "exceeds bounds (0x%08x)\n", 523 src_offset, cmd, info->name, info->len, 524 src_offset + len); 525 return -EINVAL; 526 } 527 528 if (cmd != VC4_PACKET_GEM_HANDLES) 529 memcpy(dst_pkt, src_pkt, info->len); 530 531 if (info->func && info->func(exec, 532 dst_pkt + 1, 533 src_pkt + 1)) { 534 DRM_DEBUG("0x%08x: packet %d (%s) failed to validate\n", 535 src_offset, cmd, info->name); 536 return -EINVAL; 537 } 538 539 src_offset += info->len; 540 /* GEM handle loading doesn't produce HW packets. */ 541 if (cmd != VC4_PACKET_GEM_HANDLES) 542 dst_offset += info->len; 543 544 /* When the CL hits halt, it'll stop reading anything else. */ 545 if (cmd == VC4_PACKET_HALT) 546 break; 547 } 548 549 exec->ct0ea = exec->ct0ca + dst_offset; 550 551 if (!exec->found_start_tile_binning_packet) { 552 DRM_DEBUG("Bin CL missing VC4_PACKET_START_TILE_BINNING\n"); 553 return -EINVAL; 554 } 555 556 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The 557 * semaphore is used to trigger the render CL to start up, and the 558 * FLUSH is what caps the bin lists with 559 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main 560 * render CL when they get called to) and actually triggers the queued 561 * semaphore increment. 562 */ 563 if (!exec->found_increment_semaphore_packet || !exec->found_flush) { 564 DRM_DEBUG("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + " 565 "VC4_PACKET_FLUSH\n"); 566 return -EINVAL; 567 } 568 569 return 0; 570 } 571 572 static bool 573 reloc_tex(struct vc4_exec_info *exec, 574 void *uniform_data_u, 575 struct vc4_texture_sample_info *sample, 576 uint32_t texture_handle_index, bool is_cs) 577 { 578 struct drm_gem_dma_object *tex; 579 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]); 580 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]); 581 uint32_t p2 = (sample->p_offset[2] != ~0 ? 582 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0); 583 uint32_t p3 = (sample->p_offset[3] != ~0 ? 584 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0); 585 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0]; 586 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK; 587 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS); 588 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH); 589 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT); 590 uint32_t cpp, tiling_format, utile_w, utile_h; 591 uint32_t i; 592 uint32_t cube_map_stride = 0; 593 enum vc4_texture_data_type type; 594 595 tex = vc4_use_bo(exec, texture_handle_index); 596 if (!tex) 597 return false; 598 599 if (sample->is_direct) { 600 uint32_t remaining_size = tex->base.size - p0; 601 602 if (p0 > tex->base.size - 4) { 603 DRM_DEBUG("UBO offset greater than UBO size\n"); 604 goto fail; 605 } 606 if (p1 > remaining_size - 4) { 607 DRM_DEBUG("UBO clamp would allow reads " 608 "outside of UBO\n"); 609 goto fail; 610 } 611 *validated_p0 = tex->dma_addr + p0; 612 return true; 613 } 614 615 if (width == 0) 616 width = 2048; 617 if (height == 0) 618 height = 2048; 619 620 if (p0 & VC4_TEX_P0_CMMODE_MASK) { 621 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) == 622 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) 623 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK; 624 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) == 625 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) { 626 if (cube_map_stride) { 627 DRM_DEBUG("Cube map stride set twice\n"); 628 goto fail; 629 } 630 631 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK; 632 } 633 if (!cube_map_stride) { 634 DRM_DEBUG("Cube map stride not set\n"); 635 goto fail; 636 } 637 } 638 639 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) | 640 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4)); 641 642 switch (type) { 643 case VC4_TEXTURE_TYPE_RGBA8888: 644 case VC4_TEXTURE_TYPE_RGBX8888: 645 case VC4_TEXTURE_TYPE_RGBA32R: 646 cpp = 4; 647 break; 648 case VC4_TEXTURE_TYPE_RGBA4444: 649 case VC4_TEXTURE_TYPE_RGBA5551: 650 case VC4_TEXTURE_TYPE_RGB565: 651 case VC4_TEXTURE_TYPE_LUMALPHA: 652 case VC4_TEXTURE_TYPE_S16F: 653 case VC4_TEXTURE_TYPE_S16: 654 cpp = 2; 655 break; 656 case VC4_TEXTURE_TYPE_LUMINANCE: 657 case VC4_TEXTURE_TYPE_ALPHA: 658 case VC4_TEXTURE_TYPE_S8: 659 cpp = 1; 660 break; 661 case VC4_TEXTURE_TYPE_ETC1: 662 /* ETC1 is arranged as 64-bit blocks, where each block is 4x4 663 * pixels. 664 */ 665 cpp = 8; 666 width = (width + 3) >> 2; 667 height = (height + 3) >> 2; 668 break; 669 case VC4_TEXTURE_TYPE_BW1: 670 case VC4_TEXTURE_TYPE_A4: 671 case VC4_TEXTURE_TYPE_A1: 672 case VC4_TEXTURE_TYPE_RGBA64: 673 case VC4_TEXTURE_TYPE_YUV422R: 674 default: 675 DRM_DEBUG("Texture format %d unsupported\n", type); 676 goto fail; 677 } 678 utile_w = utile_width(cpp); 679 utile_h = utile_height(cpp); 680 681 if (type == VC4_TEXTURE_TYPE_RGBA32R) { 682 tiling_format = VC4_TILING_FORMAT_LINEAR; 683 } else { 684 if (size_is_lt(width, height, cpp)) 685 tiling_format = VC4_TILING_FORMAT_LT; 686 else 687 tiling_format = VC4_TILING_FORMAT_T; 688 } 689 690 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5, 691 tiling_format, width, height, cpp)) { 692 goto fail; 693 } 694 695 /* The mipmap levels are stored before the base of the texture. Make 696 * sure there is actually space in the BO. 697 */ 698 for (i = 1; i <= miplevels; i++) { 699 uint32_t level_width = max(width >> i, 1u); 700 uint32_t level_height = max(height >> i, 1u); 701 uint32_t aligned_width, aligned_height; 702 uint32_t level_size; 703 704 /* Once the levels get small enough, they drop from T to LT. */ 705 if (tiling_format == VC4_TILING_FORMAT_T && 706 size_is_lt(level_width, level_height, cpp)) { 707 tiling_format = VC4_TILING_FORMAT_LT; 708 } 709 710 switch (tiling_format) { 711 case VC4_TILING_FORMAT_T: 712 aligned_width = round_up(level_width, utile_w * 8); 713 aligned_height = round_up(level_height, utile_h * 8); 714 break; 715 case VC4_TILING_FORMAT_LT: 716 aligned_width = round_up(level_width, utile_w); 717 aligned_height = round_up(level_height, utile_h); 718 break; 719 default: 720 aligned_width = round_up(level_width, utile_w); 721 aligned_height = level_height; 722 break; 723 } 724 725 level_size = aligned_width * cpp * aligned_height; 726 727 if (offset < level_size) { 728 DRM_DEBUG("Level %d (%dx%d -> %dx%d) size %db " 729 "overflowed buffer bounds (offset %d)\n", 730 i, level_width, level_height, 731 aligned_width, aligned_height, 732 level_size, offset); 733 goto fail; 734 } 735 736 offset -= level_size; 737 } 738 739 *validated_p0 = tex->dma_addr + p0; 740 741 if (is_cs) { 742 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 743 to_vc4_bo(&tex->base)->write_seqno); 744 } 745 746 return true; 747 fail: 748 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0); 749 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1); 750 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2); 751 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3); 752 return false; 753 } 754 755 static int 756 validate_gl_shader_rec(struct drm_device *dev, 757 struct vc4_exec_info *exec, 758 struct vc4_shader_state *state) 759 { 760 uint32_t *src_handles; 761 void *pkt_u, *pkt_v; 762 static const uint32_t shader_reloc_offsets[] = { 763 4, /* fs */ 764 16, /* vs */ 765 28, /* cs */ 766 }; 767 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets); 768 struct drm_gem_dma_object *bo[ARRAY_SIZE(shader_reloc_offsets) + 8]; 769 uint32_t nr_attributes, nr_relocs, packet_size; 770 int i; 771 772 nr_attributes = state->addr & 0x7; 773 if (nr_attributes == 0) 774 nr_attributes = 8; 775 packet_size = gl_shader_rec_size(state->addr); 776 777 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes; 778 if (nr_relocs * 4 > exec->shader_rec_size) { 779 DRM_DEBUG("overflowed shader recs reading %d handles " 780 "from %d bytes left\n", 781 nr_relocs, exec->shader_rec_size); 782 return -EINVAL; 783 } 784 src_handles = exec->shader_rec_u; 785 exec->shader_rec_u += nr_relocs * 4; 786 exec->shader_rec_size -= nr_relocs * 4; 787 788 if (packet_size > exec->shader_rec_size) { 789 DRM_DEBUG("overflowed shader recs copying %db packet " 790 "from %d bytes left\n", 791 packet_size, exec->shader_rec_size); 792 return -EINVAL; 793 } 794 pkt_u = exec->shader_rec_u; 795 pkt_v = exec->shader_rec_v; 796 memcpy(pkt_v, pkt_u, packet_size); 797 exec->shader_rec_u += packet_size; 798 /* Shader recs have to be aligned to 16 bytes (due to the attribute 799 * flags being in the low bytes), so round the next validated shader 800 * rec address up. This should be safe, since we've got so many 801 * relocations in a shader rec packet. 802 */ 803 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4); 804 exec->shader_rec_v += roundup(packet_size, 16); 805 exec->shader_rec_size -= packet_size; 806 807 for (i = 0; i < shader_reloc_count; i++) { 808 if (src_handles[i] > exec->bo_count) { 809 DRM_DEBUG("Shader handle %d too big\n", src_handles[i]); 810 return -EINVAL; 811 } 812 813 bo[i] = exec->bo[src_handles[i]]; 814 if (!bo[i]) 815 return -EINVAL; 816 } 817 for (i = shader_reloc_count; i < nr_relocs; i++) { 818 bo[i] = vc4_use_bo(exec, src_handles[i]); 819 if (!bo[i]) 820 return -EINVAL; 821 } 822 823 if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) != 824 to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) { 825 DRM_DEBUG("Thread mode of CL and FS do not match\n"); 826 return -EINVAL; 827 } 828 829 if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded || 830 to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) { 831 DRM_DEBUG("cs and vs cannot be threaded\n"); 832 return -EINVAL; 833 } 834 835 for (i = 0; i < shader_reloc_count; i++) { 836 struct vc4_validated_shader_info *validated_shader; 837 uint32_t o = shader_reloc_offsets[i]; 838 uint32_t src_offset = *(uint32_t *)(pkt_u + o); 839 uint32_t *texture_handles_u; 840 void *uniform_data_u; 841 uint32_t tex, uni; 842 843 *(uint32_t *)(pkt_v + o) = bo[i]->dma_addr + src_offset; 844 845 if (src_offset != 0) { 846 DRM_DEBUG("Shaders must be at offset 0 of " 847 "the BO.\n"); 848 return -EINVAL; 849 } 850 851 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader; 852 if (!validated_shader) 853 return -EINVAL; 854 855 if (validated_shader->uniforms_src_size > 856 exec->uniforms_size) { 857 DRM_DEBUG("Uniforms src buffer overflow\n"); 858 return -EINVAL; 859 } 860 861 texture_handles_u = exec->uniforms_u; 862 uniform_data_u = (texture_handles_u + 863 validated_shader->num_texture_samples); 864 865 memcpy(exec->uniforms_v, uniform_data_u, 866 validated_shader->uniforms_size); 867 868 for (tex = 0; 869 tex < validated_shader->num_texture_samples; 870 tex++) { 871 if (!reloc_tex(exec, 872 uniform_data_u, 873 &validated_shader->texture_samples[tex], 874 texture_handles_u[tex], 875 i == 2)) { 876 return -EINVAL; 877 } 878 } 879 880 /* Fill in the uniform slots that need this shader's 881 * start-of-uniforms address (used for resetting the uniform 882 * stream in the presence of control flow). 883 */ 884 for (uni = 0; 885 uni < validated_shader->num_uniform_addr_offsets; 886 uni++) { 887 uint32_t o = validated_shader->uniform_addr_offsets[uni]; 888 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p; 889 } 890 891 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p; 892 893 exec->uniforms_u += validated_shader->uniforms_src_size; 894 exec->uniforms_v += validated_shader->uniforms_size; 895 exec->uniforms_p += validated_shader->uniforms_size; 896 } 897 898 for (i = 0; i < nr_attributes; i++) { 899 struct drm_gem_dma_object *vbo = 900 bo[ARRAY_SIZE(shader_reloc_offsets) + i]; 901 uint32_t o = 36 + i * 8; 902 uint32_t offset = *(uint32_t *)(pkt_u + o + 0); 903 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1; 904 uint32_t stride = *(uint8_t *)(pkt_u + o + 5); 905 uint32_t max_index; 906 907 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 908 to_vc4_bo(&vbo->base)->write_seqno); 909 910 if (state->addr & 0x8) 911 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff; 912 913 if (vbo->base.size < offset || 914 vbo->base.size - offset < attr_size) { 915 DRM_DEBUG("BO offset overflow (%d + %d > %zu)\n", 916 offset, attr_size, vbo->base.size); 917 return -EINVAL; 918 } 919 920 if (stride != 0) { 921 max_index = ((vbo->base.size - offset - attr_size) / 922 stride); 923 if (state->max_index > max_index) { 924 DRM_DEBUG("primitives use index %d out of " 925 "supplied %d\n", 926 state->max_index, max_index); 927 return -EINVAL; 928 } 929 } 930 931 *(uint32_t *)(pkt_v + o) = vbo->dma_addr + offset; 932 } 933 934 return 0; 935 } 936 937 int 938 vc4_validate_shader_recs(struct drm_device *dev, 939 struct vc4_exec_info *exec) 940 { 941 struct vc4_dev *vc4 = to_vc4_dev(dev); 942 uint32_t i; 943 int ret = 0; 944 945 if (WARN_ON_ONCE(vc4->is_vc5)) 946 return -ENODEV; 947 948 for (i = 0; i < exec->shader_state_count; i++) { 949 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]); 950 if (ret) 951 return ret; 952 } 953 954 return ret; 955 } 956