1 /* 2 * Copyright © 2014 Broadcom 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 */ 23 24 /** 25 * Command list validator for VC4. 26 * 27 * The VC4 has no IOMMU between it and system memory. So, a user with 28 * access to execute command lists could escalate privilege by 29 * overwriting system memory (drawing to it as a framebuffer) or 30 * reading system memory it shouldn't (reading it as a texture, or 31 * uniform data, or vertex data). 32 * 33 * This validates command lists to ensure that all accesses are within 34 * the bounds of the GEM objects referenced. It explicitly whitelists 35 * packets, and looks at the offsets in any address fields to make 36 * sure they're constrained within the BOs they reference. 37 * 38 * Note that because of the validation that's happening anyway, this 39 * is where GEM relocation processing happens. 40 */ 41 42 #include "uapi/drm/vc4_drm.h" 43 #include "vc4_drv.h" 44 #include "vc4_packet.h" 45 46 #define VALIDATE_ARGS \ 47 struct vc4_exec_info *exec, \ 48 void *validated, \ 49 void *untrusted 50 51 /** Return the width in pixels of a 64-byte microtile. */ 52 static uint32_t 53 utile_width(int cpp) 54 { 55 switch (cpp) { 56 case 1: 57 case 2: 58 return 8; 59 case 4: 60 return 4; 61 case 8: 62 return 2; 63 default: 64 DRM_ERROR("unknown cpp: %d\n", cpp); 65 return 1; 66 } 67 } 68 69 /** Return the height in pixels of a 64-byte microtile. */ 70 static uint32_t 71 utile_height(int cpp) 72 { 73 switch (cpp) { 74 case 1: 75 return 8; 76 case 2: 77 case 4: 78 case 8: 79 return 4; 80 default: 81 DRM_ERROR("unknown cpp: %d\n", cpp); 82 return 1; 83 } 84 } 85 86 /** 87 * The texture unit decides what tiling format a particular miplevel is using 88 * this function, so we lay out our miptrees accordingly. 89 */ 90 static bool 91 size_is_lt(uint32_t width, uint32_t height, int cpp) 92 { 93 return (width <= 4 * utile_width(cpp) || 94 height <= 4 * utile_height(cpp)); 95 } 96 97 struct drm_gem_cma_object * 98 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex) 99 { 100 struct drm_gem_cma_object *obj; 101 struct vc4_bo *bo; 102 103 if (hindex >= exec->bo_count) { 104 DRM_ERROR("BO index %d greater than BO count %d\n", 105 hindex, exec->bo_count); 106 return NULL; 107 } 108 obj = exec->bo[hindex]; 109 bo = to_vc4_bo(&obj->base); 110 111 if (bo->validated_shader) { 112 DRM_ERROR("Trying to use shader BO as something other than " 113 "a shader\n"); 114 return NULL; 115 } 116 117 return obj; 118 } 119 120 static struct drm_gem_cma_object * 121 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index) 122 { 123 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]); 124 } 125 126 static bool 127 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos) 128 { 129 /* Note that the untrusted pointer passed to these functions is 130 * incremented past the packet byte. 131 */ 132 return (untrusted - 1 == exec->bin_u + pos); 133 } 134 135 static uint32_t 136 gl_shader_rec_size(uint32_t pointer_bits) 137 { 138 uint32_t attribute_count = pointer_bits & 7; 139 bool extended = pointer_bits & 8; 140 141 if (attribute_count == 0) 142 attribute_count = 8; 143 144 if (extended) 145 return 100 + attribute_count * 4; 146 else 147 return 36 + attribute_count * 8; 148 } 149 150 bool 151 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_cma_object *fbo, 152 uint32_t offset, uint8_t tiling_format, 153 uint32_t width, uint32_t height, uint8_t cpp) 154 { 155 uint32_t aligned_width, aligned_height, stride, size; 156 uint32_t utile_w = utile_width(cpp); 157 uint32_t utile_h = utile_height(cpp); 158 159 /* The shaded vertex format stores signed 12.4 fixed point 160 * (-2048,2047) offsets from the viewport center, so we should 161 * never have a render target larger than 4096. The texture 162 * unit can only sample from 2048x2048, so it's even more 163 * restricted. This lets us avoid worrying about overflow in 164 * our math. 165 */ 166 if (width > 4096 || height > 4096) { 167 DRM_ERROR("Surface dimesions (%d,%d) too large", width, height); 168 return false; 169 } 170 171 switch (tiling_format) { 172 case VC4_TILING_FORMAT_LINEAR: 173 aligned_width = round_up(width, utile_w); 174 aligned_height = height; 175 break; 176 case VC4_TILING_FORMAT_T: 177 aligned_width = round_up(width, utile_w * 8); 178 aligned_height = round_up(height, utile_h * 8); 179 break; 180 case VC4_TILING_FORMAT_LT: 181 aligned_width = round_up(width, utile_w); 182 aligned_height = round_up(height, utile_h); 183 break; 184 default: 185 DRM_ERROR("buffer tiling %d unsupported\n", tiling_format); 186 return false; 187 } 188 189 stride = aligned_width * cpp; 190 size = stride * aligned_height; 191 192 if (size + offset < size || 193 size + offset > fbo->base.size) { 194 DRM_ERROR("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n", 195 width, height, 196 aligned_width, aligned_height, 197 size, offset, fbo->base.size); 198 return false; 199 } 200 201 return true; 202 } 203 204 static int 205 validate_flush(VALIDATE_ARGS) 206 { 207 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) { 208 DRM_ERROR("Bin CL must end with VC4_PACKET_FLUSH\n"); 209 return -EINVAL; 210 } 211 exec->found_flush = true; 212 213 return 0; 214 } 215 216 static int 217 validate_start_tile_binning(VALIDATE_ARGS) 218 { 219 if (exec->found_start_tile_binning_packet) { 220 DRM_ERROR("Duplicate VC4_PACKET_START_TILE_BINNING\n"); 221 return -EINVAL; 222 } 223 exec->found_start_tile_binning_packet = true; 224 225 if (!exec->found_tile_binning_mode_config_packet) { 226 DRM_ERROR("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 227 return -EINVAL; 228 } 229 230 return 0; 231 } 232 233 static int 234 validate_increment_semaphore(VALIDATE_ARGS) 235 { 236 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) { 237 DRM_ERROR("Bin CL must end with " 238 "VC4_PACKET_INCREMENT_SEMAPHORE\n"); 239 return -EINVAL; 240 } 241 exec->found_increment_semaphore_packet = true; 242 243 return 0; 244 } 245 246 static int 247 validate_indexed_prim_list(VALIDATE_ARGS) 248 { 249 struct drm_gem_cma_object *ib; 250 uint32_t length = *(uint32_t *)(untrusted + 1); 251 uint32_t offset = *(uint32_t *)(untrusted + 5); 252 uint32_t max_index = *(uint32_t *)(untrusted + 9); 253 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1; 254 struct vc4_shader_state *shader_state; 255 256 /* Check overflow condition */ 257 if (exec->shader_state_count == 0) { 258 DRM_ERROR("shader state must precede primitives\n"); 259 return -EINVAL; 260 } 261 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 262 263 if (max_index > shader_state->max_index) 264 shader_state->max_index = max_index; 265 266 ib = vc4_use_handle(exec, 0); 267 if (!ib) 268 return -EINVAL; 269 270 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 271 to_vc4_bo(&ib->base)->write_seqno); 272 273 if (offset > ib->base.size || 274 (ib->base.size - offset) / index_size < length) { 275 DRM_ERROR("IB access overflow (%d + %d*%d > %zd)\n", 276 offset, length, index_size, ib->base.size); 277 return -EINVAL; 278 } 279 280 *(uint32_t *)(validated + 5) = ib->paddr + offset; 281 282 return 0; 283 } 284 285 static int 286 validate_gl_array_primitive(VALIDATE_ARGS) 287 { 288 uint32_t length = *(uint32_t *)(untrusted + 1); 289 uint32_t base_index = *(uint32_t *)(untrusted + 5); 290 uint32_t max_index; 291 struct vc4_shader_state *shader_state; 292 293 /* Check overflow condition */ 294 if (exec->shader_state_count == 0) { 295 DRM_ERROR("shader state must precede primitives\n"); 296 return -EINVAL; 297 } 298 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 299 300 if (length + base_index < length) { 301 DRM_ERROR("primitive vertex count overflow\n"); 302 return -EINVAL; 303 } 304 max_index = length + base_index - 1; 305 306 if (max_index > shader_state->max_index) 307 shader_state->max_index = max_index; 308 309 return 0; 310 } 311 312 static int 313 validate_gl_shader_state(VALIDATE_ARGS) 314 { 315 uint32_t i = exec->shader_state_count++; 316 317 if (i >= exec->shader_state_size) { 318 DRM_ERROR("More requests for shader states than declared\n"); 319 return -EINVAL; 320 } 321 322 exec->shader_state[i].addr = *(uint32_t *)untrusted; 323 exec->shader_state[i].max_index = 0; 324 325 if (exec->shader_state[i].addr & ~0xf) { 326 DRM_ERROR("high bits set in GL shader rec reference\n"); 327 return -EINVAL; 328 } 329 330 *(uint32_t *)validated = (exec->shader_rec_p + 331 exec->shader_state[i].addr); 332 333 exec->shader_rec_p += 334 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16); 335 336 return 0; 337 } 338 339 static int 340 validate_tile_binning_config(VALIDATE_ARGS) 341 { 342 struct drm_device *dev = exec->exec_bo->base.dev; 343 struct vc4_bo *tile_bo; 344 uint8_t flags; 345 uint32_t tile_state_size, tile_alloc_size; 346 uint32_t tile_count; 347 348 if (exec->found_tile_binning_mode_config_packet) { 349 DRM_ERROR("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 350 return -EINVAL; 351 } 352 exec->found_tile_binning_mode_config_packet = true; 353 354 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12); 355 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13); 356 tile_count = exec->bin_tiles_x * exec->bin_tiles_y; 357 flags = *(uint8_t *)(untrusted + 14); 358 359 if (exec->bin_tiles_x == 0 || 360 exec->bin_tiles_y == 0) { 361 DRM_ERROR("Tile binning config of %dx%d too small\n", 362 exec->bin_tiles_x, exec->bin_tiles_y); 363 return -EINVAL; 364 } 365 366 if (flags & (VC4_BIN_CONFIG_DB_NON_MS | 367 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) { 368 DRM_ERROR("unsupported binning config flags 0x%02x\n", flags); 369 return -EINVAL; 370 } 371 372 /* The tile state data array is 48 bytes per tile, and we put it at 373 * the start of a BO containing both it and the tile alloc. 374 */ 375 tile_state_size = 48 * tile_count; 376 377 /* Since the tile alloc array will follow us, align. */ 378 exec->tile_alloc_offset = roundup(tile_state_size, 4096); 379 380 *(uint8_t *)(validated + 14) = 381 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK | 382 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) | 383 VC4_BIN_CONFIG_AUTO_INIT_TSDA | 384 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32, 385 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) | 386 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128, 387 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE)); 388 389 /* Initial block size. */ 390 tile_alloc_size = 32 * tile_count; 391 392 /* 393 * The initial allocation gets rounded to the next 256 bytes before 394 * the hardware starts fulfilling further allocations. 395 */ 396 tile_alloc_size = roundup(tile_alloc_size, 256); 397 398 /* Add space for the extra allocations. This is what gets used first, 399 * before overflow memory. It must have at least 4096 bytes, but we 400 * want to avoid overflow memory usage if possible. 401 */ 402 tile_alloc_size += 1024 * 1024; 403 404 tile_bo = vc4_bo_create(dev, exec->tile_alloc_offset + tile_alloc_size, 405 true); 406 exec->tile_bo = &tile_bo->base; 407 if (IS_ERR(exec->tile_bo)) 408 return PTR_ERR(exec->tile_bo); 409 list_add_tail(&tile_bo->unref_head, &exec->unref_list); 410 411 /* tile alloc address. */ 412 *(uint32_t *)(validated + 0) = (exec->tile_bo->paddr + 413 exec->tile_alloc_offset); 414 /* tile alloc size. */ 415 *(uint32_t *)(validated + 4) = tile_alloc_size; 416 /* tile state address. */ 417 *(uint32_t *)(validated + 8) = exec->tile_bo->paddr; 418 419 return 0; 420 } 421 422 static int 423 validate_gem_handles(VALIDATE_ARGS) 424 { 425 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index)); 426 return 0; 427 } 428 429 #define VC4_DEFINE_PACKET(packet, func) \ 430 [packet] = { packet ## _SIZE, #packet, func } 431 432 static const struct cmd_info { 433 uint16_t len; 434 const char *name; 435 int (*func)(struct vc4_exec_info *exec, void *validated, 436 void *untrusted); 437 } cmd_info[] = { 438 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL), 439 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL), 440 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush), 441 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL), 442 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING, 443 validate_start_tile_binning), 444 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE, 445 validate_increment_semaphore), 446 447 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE, 448 validate_indexed_prim_list), 449 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE, 450 validate_gl_array_primitive), 451 452 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL), 453 454 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state), 455 456 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL), 457 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL), 458 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL), 459 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL), 460 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL), 461 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL), 462 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL), 463 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL), 464 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL), 465 /* Note: The docs say this was also 105, but it was 106 in the 466 * initial userland code drop. 467 */ 468 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL), 469 470 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG, 471 validate_tile_binning_config), 472 473 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles), 474 }; 475 476 int 477 vc4_validate_bin_cl(struct drm_device *dev, 478 void *validated, 479 void *unvalidated, 480 struct vc4_exec_info *exec) 481 { 482 uint32_t len = exec->args->bin_cl_size; 483 uint32_t dst_offset = 0; 484 uint32_t src_offset = 0; 485 486 while (src_offset < len) { 487 void *dst_pkt = validated + dst_offset; 488 void *src_pkt = unvalidated + src_offset; 489 u8 cmd = *(uint8_t *)src_pkt; 490 const struct cmd_info *info; 491 492 if (cmd >= ARRAY_SIZE(cmd_info)) { 493 DRM_ERROR("0x%08x: packet %d out of bounds\n", 494 src_offset, cmd); 495 return -EINVAL; 496 } 497 498 info = &cmd_info[cmd]; 499 if (!info->name) { 500 DRM_ERROR("0x%08x: packet %d invalid\n", 501 src_offset, cmd); 502 return -EINVAL; 503 } 504 505 if (src_offset + info->len > len) { 506 DRM_ERROR("0x%08x: packet %d (%s) length 0x%08x " 507 "exceeds bounds (0x%08x)\n", 508 src_offset, cmd, info->name, info->len, 509 src_offset + len); 510 return -EINVAL; 511 } 512 513 if (cmd != VC4_PACKET_GEM_HANDLES) 514 memcpy(dst_pkt, src_pkt, info->len); 515 516 if (info->func && info->func(exec, 517 dst_pkt + 1, 518 src_pkt + 1)) { 519 DRM_ERROR("0x%08x: packet %d (%s) failed to validate\n", 520 src_offset, cmd, info->name); 521 return -EINVAL; 522 } 523 524 src_offset += info->len; 525 /* GEM handle loading doesn't produce HW packets. */ 526 if (cmd != VC4_PACKET_GEM_HANDLES) 527 dst_offset += info->len; 528 529 /* When the CL hits halt, it'll stop reading anything else. */ 530 if (cmd == VC4_PACKET_HALT) 531 break; 532 } 533 534 exec->ct0ea = exec->ct0ca + dst_offset; 535 536 if (!exec->found_start_tile_binning_packet) { 537 DRM_ERROR("Bin CL missing VC4_PACKET_START_TILE_BINNING\n"); 538 return -EINVAL; 539 } 540 541 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The 542 * semaphore is used to trigger the render CL to start up, and the 543 * FLUSH is what caps the bin lists with 544 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main 545 * render CL when they get called to) and actually triggers the queued 546 * semaphore increment. 547 */ 548 if (!exec->found_increment_semaphore_packet || !exec->found_flush) { 549 DRM_ERROR("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + " 550 "VC4_PACKET_FLUSH\n"); 551 return -EINVAL; 552 } 553 554 return 0; 555 } 556 557 static bool 558 reloc_tex(struct vc4_exec_info *exec, 559 void *uniform_data_u, 560 struct vc4_texture_sample_info *sample, 561 uint32_t texture_handle_index, bool is_cs) 562 { 563 struct drm_gem_cma_object *tex; 564 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]); 565 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]); 566 uint32_t p2 = (sample->p_offset[2] != ~0 ? 567 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0); 568 uint32_t p3 = (sample->p_offset[3] != ~0 ? 569 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0); 570 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0]; 571 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK; 572 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS); 573 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH); 574 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT); 575 uint32_t cpp, tiling_format, utile_w, utile_h; 576 uint32_t i; 577 uint32_t cube_map_stride = 0; 578 enum vc4_texture_data_type type; 579 580 tex = vc4_use_bo(exec, texture_handle_index); 581 if (!tex) 582 return false; 583 584 if (sample->is_direct) { 585 uint32_t remaining_size = tex->base.size - p0; 586 587 if (p0 > tex->base.size - 4) { 588 DRM_ERROR("UBO offset greater than UBO size\n"); 589 goto fail; 590 } 591 if (p1 > remaining_size - 4) { 592 DRM_ERROR("UBO clamp would allow reads " 593 "outside of UBO\n"); 594 goto fail; 595 } 596 *validated_p0 = tex->paddr + p0; 597 return true; 598 } 599 600 if (width == 0) 601 width = 2048; 602 if (height == 0) 603 height = 2048; 604 605 if (p0 & VC4_TEX_P0_CMMODE_MASK) { 606 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) == 607 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) 608 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK; 609 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) == 610 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) { 611 if (cube_map_stride) { 612 DRM_ERROR("Cube map stride set twice\n"); 613 goto fail; 614 } 615 616 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK; 617 } 618 if (!cube_map_stride) { 619 DRM_ERROR("Cube map stride not set\n"); 620 goto fail; 621 } 622 } 623 624 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) | 625 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4)); 626 627 switch (type) { 628 case VC4_TEXTURE_TYPE_RGBA8888: 629 case VC4_TEXTURE_TYPE_RGBX8888: 630 case VC4_TEXTURE_TYPE_RGBA32R: 631 cpp = 4; 632 break; 633 case VC4_TEXTURE_TYPE_RGBA4444: 634 case VC4_TEXTURE_TYPE_RGBA5551: 635 case VC4_TEXTURE_TYPE_RGB565: 636 case VC4_TEXTURE_TYPE_LUMALPHA: 637 case VC4_TEXTURE_TYPE_S16F: 638 case VC4_TEXTURE_TYPE_S16: 639 cpp = 2; 640 break; 641 case VC4_TEXTURE_TYPE_LUMINANCE: 642 case VC4_TEXTURE_TYPE_ALPHA: 643 case VC4_TEXTURE_TYPE_S8: 644 cpp = 1; 645 break; 646 case VC4_TEXTURE_TYPE_ETC1: 647 case VC4_TEXTURE_TYPE_BW1: 648 case VC4_TEXTURE_TYPE_A4: 649 case VC4_TEXTURE_TYPE_A1: 650 case VC4_TEXTURE_TYPE_RGBA64: 651 case VC4_TEXTURE_TYPE_YUV422R: 652 default: 653 DRM_ERROR("Texture format %d unsupported\n", type); 654 goto fail; 655 } 656 utile_w = utile_width(cpp); 657 utile_h = utile_height(cpp); 658 659 if (type == VC4_TEXTURE_TYPE_RGBA32R) { 660 tiling_format = VC4_TILING_FORMAT_LINEAR; 661 } else { 662 if (size_is_lt(width, height, cpp)) 663 tiling_format = VC4_TILING_FORMAT_LT; 664 else 665 tiling_format = VC4_TILING_FORMAT_T; 666 } 667 668 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5, 669 tiling_format, width, height, cpp)) { 670 goto fail; 671 } 672 673 /* The mipmap levels are stored before the base of the texture. Make 674 * sure there is actually space in the BO. 675 */ 676 for (i = 1; i <= miplevels; i++) { 677 uint32_t level_width = max(width >> i, 1u); 678 uint32_t level_height = max(height >> i, 1u); 679 uint32_t aligned_width, aligned_height; 680 uint32_t level_size; 681 682 /* Once the levels get small enough, they drop from T to LT. */ 683 if (tiling_format == VC4_TILING_FORMAT_T && 684 size_is_lt(level_width, level_height, cpp)) { 685 tiling_format = VC4_TILING_FORMAT_LT; 686 } 687 688 switch (tiling_format) { 689 case VC4_TILING_FORMAT_T: 690 aligned_width = round_up(level_width, utile_w * 8); 691 aligned_height = round_up(level_height, utile_h * 8); 692 break; 693 case VC4_TILING_FORMAT_LT: 694 aligned_width = round_up(level_width, utile_w); 695 aligned_height = round_up(level_height, utile_h); 696 break; 697 default: 698 aligned_width = round_up(level_width, utile_w); 699 aligned_height = level_height; 700 break; 701 } 702 703 level_size = aligned_width * cpp * aligned_height; 704 705 if (offset < level_size) { 706 DRM_ERROR("Level %d (%dx%d -> %dx%d) size %db " 707 "overflowed buffer bounds (offset %d)\n", 708 i, level_width, level_height, 709 aligned_width, aligned_height, 710 level_size, offset); 711 goto fail; 712 } 713 714 offset -= level_size; 715 } 716 717 *validated_p0 = tex->paddr + p0; 718 719 if (is_cs) { 720 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 721 to_vc4_bo(&tex->base)->write_seqno); 722 } 723 724 return true; 725 fail: 726 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0); 727 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1); 728 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2); 729 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3); 730 return false; 731 } 732 733 static int 734 validate_gl_shader_rec(struct drm_device *dev, 735 struct vc4_exec_info *exec, 736 struct vc4_shader_state *state) 737 { 738 uint32_t *src_handles; 739 void *pkt_u, *pkt_v; 740 static const uint32_t shader_reloc_offsets[] = { 741 4, /* fs */ 742 16, /* vs */ 743 28, /* cs */ 744 }; 745 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets); 746 struct drm_gem_cma_object *bo[shader_reloc_count + 8]; 747 uint32_t nr_attributes, nr_relocs, packet_size; 748 int i; 749 750 nr_attributes = state->addr & 0x7; 751 if (nr_attributes == 0) 752 nr_attributes = 8; 753 packet_size = gl_shader_rec_size(state->addr); 754 755 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes; 756 if (nr_relocs * 4 > exec->shader_rec_size) { 757 DRM_ERROR("overflowed shader recs reading %d handles " 758 "from %d bytes left\n", 759 nr_relocs, exec->shader_rec_size); 760 return -EINVAL; 761 } 762 src_handles = exec->shader_rec_u; 763 exec->shader_rec_u += nr_relocs * 4; 764 exec->shader_rec_size -= nr_relocs * 4; 765 766 if (packet_size > exec->shader_rec_size) { 767 DRM_ERROR("overflowed shader recs copying %db packet " 768 "from %d bytes left\n", 769 packet_size, exec->shader_rec_size); 770 return -EINVAL; 771 } 772 pkt_u = exec->shader_rec_u; 773 pkt_v = exec->shader_rec_v; 774 memcpy(pkt_v, pkt_u, packet_size); 775 exec->shader_rec_u += packet_size; 776 /* Shader recs have to be aligned to 16 bytes (due to the attribute 777 * flags being in the low bytes), so round the next validated shader 778 * rec address up. This should be safe, since we've got so many 779 * relocations in a shader rec packet. 780 */ 781 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4); 782 exec->shader_rec_v += roundup(packet_size, 16); 783 exec->shader_rec_size -= packet_size; 784 785 if (!(*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD)) { 786 DRM_ERROR("Multi-threaded fragment shaders not supported.\n"); 787 return -EINVAL; 788 } 789 790 for (i = 0; i < shader_reloc_count; i++) { 791 if (src_handles[i] > exec->bo_count) { 792 DRM_ERROR("Shader handle %d too big\n", src_handles[i]); 793 return -EINVAL; 794 } 795 796 bo[i] = exec->bo[src_handles[i]]; 797 if (!bo[i]) 798 return -EINVAL; 799 } 800 for (i = shader_reloc_count; i < nr_relocs; i++) { 801 bo[i] = vc4_use_bo(exec, src_handles[i]); 802 if (!bo[i]) 803 return -EINVAL; 804 } 805 806 for (i = 0; i < shader_reloc_count; i++) { 807 struct vc4_validated_shader_info *validated_shader; 808 uint32_t o = shader_reloc_offsets[i]; 809 uint32_t src_offset = *(uint32_t *)(pkt_u + o); 810 uint32_t *texture_handles_u; 811 void *uniform_data_u; 812 uint32_t tex, uni; 813 814 *(uint32_t *)(pkt_v + o) = bo[i]->paddr + src_offset; 815 816 if (src_offset != 0) { 817 DRM_ERROR("Shaders must be at offset 0 of " 818 "the BO.\n"); 819 return -EINVAL; 820 } 821 822 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader; 823 if (!validated_shader) 824 return -EINVAL; 825 826 if (validated_shader->uniforms_src_size > 827 exec->uniforms_size) { 828 DRM_ERROR("Uniforms src buffer overflow\n"); 829 return -EINVAL; 830 } 831 832 texture_handles_u = exec->uniforms_u; 833 uniform_data_u = (texture_handles_u + 834 validated_shader->num_texture_samples); 835 836 memcpy(exec->uniforms_v, uniform_data_u, 837 validated_shader->uniforms_size); 838 839 for (tex = 0; 840 tex < validated_shader->num_texture_samples; 841 tex++) { 842 if (!reloc_tex(exec, 843 uniform_data_u, 844 &validated_shader->texture_samples[tex], 845 texture_handles_u[tex], 846 i == 2)) { 847 return -EINVAL; 848 } 849 } 850 851 /* Fill in the uniform slots that need this shader's 852 * start-of-uniforms address (used for resetting the uniform 853 * stream in the presence of control flow). 854 */ 855 for (uni = 0; 856 uni < validated_shader->num_uniform_addr_offsets; 857 uni++) { 858 uint32_t o = validated_shader->uniform_addr_offsets[uni]; 859 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p; 860 } 861 862 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p; 863 864 exec->uniforms_u += validated_shader->uniforms_src_size; 865 exec->uniforms_v += validated_shader->uniforms_size; 866 exec->uniforms_p += validated_shader->uniforms_size; 867 } 868 869 for (i = 0; i < nr_attributes; i++) { 870 struct drm_gem_cma_object *vbo = 871 bo[ARRAY_SIZE(shader_reloc_offsets) + i]; 872 uint32_t o = 36 + i * 8; 873 uint32_t offset = *(uint32_t *)(pkt_u + o + 0); 874 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1; 875 uint32_t stride = *(uint8_t *)(pkt_u + o + 5); 876 uint32_t max_index; 877 878 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 879 to_vc4_bo(&vbo->base)->write_seqno); 880 881 if (state->addr & 0x8) 882 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff; 883 884 if (vbo->base.size < offset || 885 vbo->base.size - offset < attr_size) { 886 DRM_ERROR("BO offset overflow (%d + %d > %zu)\n", 887 offset, attr_size, vbo->base.size); 888 return -EINVAL; 889 } 890 891 if (stride != 0) { 892 max_index = ((vbo->base.size - offset - attr_size) / 893 stride); 894 if (state->max_index > max_index) { 895 DRM_ERROR("primitives use index %d out of " 896 "supplied %d\n", 897 state->max_index, max_index); 898 return -EINVAL; 899 } 900 } 901 902 *(uint32_t *)(pkt_v + o) = vbo->paddr + offset; 903 } 904 905 return 0; 906 } 907 908 int 909 vc4_validate_shader_recs(struct drm_device *dev, 910 struct vc4_exec_info *exec) 911 { 912 uint32_t i; 913 int ret = 0; 914 915 for (i = 0; i < exec->shader_state_count; i++) { 916 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]); 917 if (ret) 918 return ret; 919 } 920 921 return ret; 922 } 923