1 /* 2 * Copyright © 2014 Broadcom 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 */ 23 24 /** 25 * DOC: Command list validator for VC4. 26 * 27 * Since the VC4 has no IOMMU between it and system memory, a user 28 * with access to execute command lists could escalate privilege by 29 * overwriting system memory (drawing to it as a framebuffer) or 30 * reading system memory it shouldn't (reading it as a vertex buffer 31 * or index buffer) 32 * 33 * We validate binner command lists to ensure that all accesses are 34 * within the bounds of the GEM objects referenced by the submitted 35 * job. It explicitly whitelists packets, and looks at the offsets in 36 * any address fields to make sure they're contained within the BOs 37 * they reference. 38 * 39 * Note that because CL validation is already reading the 40 * user-submitted CL and writing the validated copy out to the memory 41 * that the GPU will actually read, this is also where GEM relocation 42 * processing (turning BO references into actual addresses for the GPU 43 * to use) happens. 44 */ 45 46 #include "uapi/drm/vc4_drm.h" 47 #include "vc4_drv.h" 48 #include "vc4_packet.h" 49 50 #define VALIDATE_ARGS \ 51 struct vc4_exec_info *exec, \ 52 void *validated, \ 53 void *untrusted 54 55 /** Return the width in pixels of a 64-byte microtile. */ 56 static uint32_t 57 utile_width(int cpp) 58 { 59 switch (cpp) { 60 case 1: 61 case 2: 62 return 8; 63 case 4: 64 return 4; 65 case 8: 66 return 2; 67 default: 68 DRM_ERROR("unknown cpp: %d\n", cpp); 69 return 1; 70 } 71 } 72 73 /** Return the height in pixels of a 64-byte microtile. */ 74 static uint32_t 75 utile_height(int cpp) 76 { 77 switch (cpp) { 78 case 1: 79 return 8; 80 case 2: 81 case 4: 82 case 8: 83 return 4; 84 default: 85 DRM_ERROR("unknown cpp: %d\n", cpp); 86 return 1; 87 } 88 } 89 90 /** 91 * size_is_lt() - Returns whether a miplevel of the given size will 92 * use the lineartile (LT) tiling layout rather than the normal T 93 * tiling layout. 94 * @width: Width in pixels of the miplevel 95 * @height: Height in pixels of the miplevel 96 * @cpp: Bytes per pixel of the pixel format 97 */ 98 static bool 99 size_is_lt(uint32_t width, uint32_t height, int cpp) 100 { 101 return (width <= 4 * utile_width(cpp) || 102 height <= 4 * utile_height(cpp)); 103 } 104 105 struct drm_gem_cma_object * 106 vc4_use_bo(struct vc4_exec_info *exec, uint32_t hindex) 107 { 108 struct drm_gem_cma_object *obj; 109 struct vc4_bo *bo; 110 111 if (hindex >= exec->bo_count) { 112 DRM_ERROR("BO index %d greater than BO count %d\n", 113 hindex, exec->bo_count); 114 return NULL; 115 } 116 obj = exec->bo[hindex]; 117 bo = to_vc4_bo(&obj->base); 118 119 if (bo->validated_shader) { 120 DRM_ERROR("Trying to use shader BO as something other than " 121 "a shader\n"); 122 return NULL; 123 } 124 125 return obj; 126 } 127 128 static struct drm_gem_cma_object * 129 vc4_use_handle(struct vc4_exec_info *exec, uint32_t gem_handles_packet_index) 130 { 131 return vc4_use_bo(exec, exec->bo_index[gem_handles_packet_index]); 132 } 133 134 static bool 135 validate_bin_pos(struct vc4_exec_info *exec, void *untrusted, uint32_t pos) 136 { 137 /* Note that the untrusted pointer passed to these functions is 138 * incremented past the packet byte. 139 */ 140 return (untrusted - 1 == exec->bin_u + pos); 141 } 142 143 static uint32_t 144 gl_shader_rec_size(uint32_t pointer_bits) 145 { 146 uint32_t attribute_count = pointer_bits & 7; 147 bool extended = pointer_bits & 8; 148 149 if (attribute_count == 0) 150 attribute_count = 8; 151 152 if (extended) 153 return 100 + attribute_count * 4; 154 else 155 return 36 + attribute_count * 8; 156 } 157 158 bool 159 vc4_check_tex_size(struct vc4_exec_info *exec, struct drm_gem_cma_object *fbo, 160 uint32_t offset, uint8_t tiling_format, 161 uint32_t width, uint32_t height, uint8_t cpp) 162 { 163 uint32_t aligned_width, aligned_height, stride, size; 164 uint32_t utile_w = utile_width(cpp); 165 uint32_t utile_h = utile_height(cpp); 166 167 /* The shaded vertex format stores signed 12.4 fixed point 168 * (-2048,2047) offsets from the viewport center, so we should 169 * never have a render target larger than 4096. The texture 170 * unit can only sample from 2048x2048, so it's even more 171 * restricted. This lets us avoid worrying about overflow in 172 * our math. 173 */ 174 if (width > 4096 || height > 4096) { 175 DRM_ERROR("Surface dimesions (%d,%d) too large", width, height); 176 return false; 177 } 178 179 switch (tiling_format) { 180 case VC4_TILING_FORMAT_LINEAR: 181 aligned_width = round_up(width, utile_w); 182 aligned_height = height; 183 break; 184 case VC4_TILING_FORMAT_T: 185 aligned_width = round_up(width, utile_w * 8); 186 aligned_height = round_up(height, utile_h * 8); 187 break; 188 case VC4_TILING_FORMAT_LT: 189 aligned_width = round_up(width, utile_w); 190 aligned_height = round_up(height, utile_h); 191 break; 192 default: 193 DRM_ERROR("buffer tiling %d unsupported\n", tiling_format); 194 return false; 195 } 196 197 stride = aligned_width * cpp; 198 size = stride * aligned_height; 199 200 if (size + offset < size || 201 size + offset > fbo->base.size) { 202 DRM_ERROR("Overflow in %dx%d (%dx%d) fbo size (%d + %d > %zd)\n", 203 width, height, 204 aligned_width, aligned_height, 205 size, offset, fbo->base.size); 206 return false; 207 } 208 209 return true; 210 } 211 212 static int 213 validate_flush(VALIDATE_ARGS) 214 { 215 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 1)) { 216 DRM_ERROR("Bin CL must end with VC4_PACKET_FLUSH\n"); 217 return -EINVAL; 218 } 219 exec->found_flush = true; 220 221 return 0; 222 } 223 224 static int 225 validate_start_tile_binning(VALIDATE_ARGS) 226 { 227 if (exec->found_start_tile_binning_packet) { 228 DRM_ERROR("Duplicate VC4_PACKET_START_TILE_BINNING\n"); 229 return -EINVAL; 230 } 231 exec->found_start_tile_binning_packet = true; 232 233 if (!exec->found_tile_binning_mode_config_packet) { 234 DRM_ERROR("missing VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 235 return -EINVAL; 236 } 237 238 return 0; 239 } 240 241 static int 242 validate_increment_semaphore(VALIDATE_ARGS) 243 { 244 if (!validate_bin_pos(exec, untrusted, exec->args->bin_cl_size - 2)) { 245 DRM_ERROR("Bin CL must end with " 246 "VC4_PACKET_INCREMENT_SEMAPHORE\n"); 247 return -EINVAL; 248 } 249 exec->found_increment_semaphore_packet = true; 250 251 return 0; 252 } 253 254 static int 255 validate_indexed_prim_list(VALIDATE_ARGS) 256 { 257 struct drm_gem_cma_object *ib; 258 uint32_t length = *(uint32_t *)(untrusted + 1); 259 uint32_t offset = *(uint32_t *)(untrusted + 5); 260 uint32_t max_index = *(uint32_t *)(untrusted + 9); 261 uint32_t index_size = (*(uint8_t *)(untrusted + 0) >> 4) ? 2 : 1; 262 struct vc4_shader_state *shader_state; 263 264 /* Check overflow condition */ 265 if (exec->shader_state_count == 0) { 266 DRM_ERROR("shader state must precede primitives\n"); 267 return -EINVAL; 268 } 269 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 270 271 if (max_index > shader_state->max_index) 272 shader_state->max_index = max_index; 273 274 ib = vc4_use_handle(exec, 0); 275 if (!ib) 276 return -EINVAL; 277 278 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 279 to_vc4_bo(&ib->base)->write_seqno); 280 281 if (offset > ib->base.size || 282 (ib->base.size - offset) / index_size < length) { 283 DRM_ERROR("IB access overflow (%d + %d*%d > %zd)\n", 284 offset, length, index_size, ib->base.size); 285 return -EINVAL; 286 } 287 288 *(uint32_t *)(validated + 5) = ib->paddr + offset; 289 290 return 0; 291 } 292 293 static int 294 validate_gl_array_primitive(VALIDATE_ARGS) 295 { 296 uint32_t length = *(uint32_t *)(untrusted + 1); 297 uint32_t base_index = *(uint32_t *)(untrusted + 5); 298 uint32_t max_index; 299 struct vc4_shader_state *shader_state; 300 301 /* Check overflow condition */ 302 if (exec->shader_state_count == 0) { 303 DRM_ERROR("shader state must precede primitives\n"); 304 return -EINVAL; 305 } 306 shader_state = &exec->shader_state[exec->shader_state_count - 1]; 307 308 if (length + base_index < length) { 309 DRM_ERROR("primitive vertex count overflow\n"); 310 return -EINVAL; 311 } 312 max_index = length + base_index - 1; 313 314 if (max_index > shader_state->max_index) 315 shader_state->max_index = max_index; 316 317 return 0; 318 } 319 320 static int 321 validate_gl_shader_state(VALIDATE_ARGS) 322 { 323 uint32_t i = exec->shader_state_count++; 324 325 if (i >= exec->shader_state_size) { 326 DRM_ERROR("More requests for shader states than declared\n"); 327 return -EINVAL; 328 } 329 330 exec->shader_state[i].addr = *(uint32_t *)untrusted; 331 exec->shader_state[i].max_index = 0; 332 333 if (exec->shader_state[i].addr & ~0xf) { 334 DRM_ERROR("high bits set in GL shader rec reference\n"); 335 return -EINVAL; 336 } 337 338 *(uint32_t *)validated = (exec->shader_rec_p + 339 exec->shader_state[i].addr); 340 341 exec->shader_rec_p += 342 roundup(gl_shader_rec_size(exec->shader_state[i].addr), 16); 343 344 return 0; 345 } 346 347 static int 348 validate_tile_binning_config(VALIDATE_ARGS) 349 { 350 struct drm_device *dev = exec->exec_bo->base.dev; 351 struct vc4_dev *vc4 = to_vc4_dev(dev); 352 uint8_t flags; 353 uint32_t tile_state_size; 354 uint32_t tile_count, bin_addr; 355 int bin_slot; 356 357 if (exec->found_tile_binning_mode_config_packet) { 358 DRM_ERROR("Duplicate VC4_PACKET_TILE_BINNING_MODE_CONFIG\n"); 359 return -EINVAL; 360 } 361 exec->found_tile_binning_mode_config_packet = true; 362 363 exec->bin_tiles_x = *(uint8_t *)(untrusted + 12); 364 exec->bin_tiles_y = *(uint8_t *)(untrusted + 13); 365 tile_count = exec->bin_tiles_x * exec->bin_tiles_y; 366 flags = *(uint8_t *)(untrusted + 14); 367 368 if (exec->bin_tiles_x == 0 || 369 exec->bin_tiles_y == 0) { 370 DRM_ERROR("Tile binning config of %dx%d too small\n", 371 exec->bin_tiles_x, exec->bin_tiles_y); 372 return -EINVAL; 373 } 374 375 if (flags & (VC4_BIN_CONFIG_DB_NON_MS | 376 VC4_BIN_CONFIG_TILE_BUFFER_64BIT)) { 377 DRM_ERROR("unsupported binning config flags 0x%02x\n", flags); 378 return -EINVAL; 379 } 380 381 bin_slot = vc4_v3d_get_bin_slot(vc4); 382 if (bin_slot < 0) { 383 if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) { 384 DRM_ERROR("Failed to allocate binner memory: %d\n", 385 bin_slot); 386 } 387 return bin_slot; 388 } 389 390 /* The slot we allocated will only be used by this job, and is 391 * free when the job completes rendering. 392 */ 393 exec->bin_slots |= BIT(bin_slot); 394 bin_addr = vc4->bin_bo->base.paddr + bin_slot * vc4->bin_alloc_size; 395 396 /* The tile state data array is 48 bytes per tile, and we put it at 397 * the start of a BO containing both it and the tile alloc. 398 */ 399 tile_state_size = 48 * tile_count; 400 401 /* Since the tile alloc array will follow us, align. */ 402 exec->tile_alloc_offset = bin_addr + roundup(tile_state_size, 4096); 403 404 *(uint8_t *)(validated + 14) = 405 ((flags & ~(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_MASK | 406 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_MASK)) | 407 VC4_BIN_CONFIG_AUTO_INIT_TSDA | 408 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE_32, 409 VC4_BIN_CONFIG_ALLOC_INIT_BLOCK_SIZE) | 410 VC4_SET_FIELD(VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE_128, 411 VC4_BIN_CONFIG_ALLOC_BLOCK_SIZE)); 412 413 /* tile alloc address. */ 414 *(uint32_t *)(validated + 0) = exec->tile_alloc_offset; 415 /* tile alloc size. */ 416 *(uint32_t *)(validated + 4) = (bin_addr + vc4->bin_alloc_size - 417 exec->tile_alloc_offset); 418 /* tile state address. */ 419 *(uint32_t *)(validated + 8) = bin_addr; 420 421 return 0; 422 } 423 424 static int 425 validate_gem_handles(VALIDATE_ARGS) 426 { 427 memcpy(exec->bo_index, untrusted, sizeof(exec->bo_index)); 428 return 0; 429 } 430 431 #define VC4_DEFINE_PACKET(packet, func) \ 432 [packet] = { packet ## _SIZE, #packet, func } 433 434 static const struct cmd_info { 435 uint16_t len; 436 const char *name; 437 int (*func)(struct vc4_exec_info *exec, void *validated, 438 void *untrusted); 439 } cmd_info[] = { 440 VC4_DEFINE_PACKET(VC4_PACKET_HALT, NULL), 441 VC4_DEFINE_PACKET(VC4_PACKET_NOP, NULL), 442 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH, validate_flush), 443 VC4_DEFINE_PACKET(VC4_PACKET_FLUSH_ALL, NULL), 444 VC4_DEFINE_PACKET(VC4_PACKET_START_TILE_BINNING, 445 validate_start_tile_binning), 446 VC4_DEFINE_PACKET(VC4_PACKET_INCREMENT_SEMAPHORE, 447 validate_increment_semaphore), 448 449 VC4_DEFINE_PACKET(VC4_PACKET_GL_INDEXED_PRIMITIVE, 450 validate_indexed_prim_list), 451 VC4_DEFINE_PACKET(VC4_PACKET_GL_ARRAY_PRIMITIVE, 452 validate_gl_array_primitive), 453 454 VC4_DEFINE_PACKET(VC4_PACKET_PRIMITIVE_LIST_FORMAT, NULL), 455 456 VC4_DEFINE_PACKET(VC4_PACKET_GL_SHADER_STATE, validate_gl_shader_state), 457 458 VC4_DEFINE_PACKET(VC4_PACKET_CONFIGURATION_BITS, NULL), 459 VC4_DEFINE_PACKET(VC4_PACKET_FLAT_SHADE_FLAGS, NULL), 460 VC4_DEFINE_PACKET(VC4_PACKET_POINT_SIZE, NULL), 461 VC4_DEFINE_PACKET(VC4_PACKET_LINE_WIDTH, NULL), 462 VC4_DEFINE_PACKET(VC4_PACKET_RHT_X_BOUNDARY, NULL), 463 VC4_DEFINE_PACKET(VC4_PACKET_DEPTH_OFFSET, NULL), 464 VC4_DEFINE_PACKET(VC4_PACKET_CLIP_WINDOW, NULL), 465 VC4_DEFINE_PACKET(VC4_PACKET_VIEWPORT_OFFSET, NULL), 466 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_XY_SCALING, NULL), 467 /* Note: The docs say this was also 105, but it was 106 in the 468 * initial userland code drop. 469 */ 470 VC4_DEFINE_PACKET(VC4_PACKET_CLIPPER_Z_SCALING, NULL), 471 472 VC4_DEFINE_PACKET(VC4_PACKET_TILE_BINNING_MODE_CONFIG, 473 validate_tile_binning_config), 474 475 VC4_DEFINE_PACKET(VC4_PACKET_GEM_HANDLES, validate_gem_handles), 476 }; 477 478 int 479 vc4_validate_bin_cl(struct drm_device *dev, 480 void *validated, 481 void *unvalidated, 482 struct vc4_exec_info *exec) 483 { 484 uint32_t len = exec->args->bin_cl_size; 485 uint32_t dst_offset = 0; 486 uint32_t src_offset = 0; 487 488 while (src_offset < len) { 489 void *dst_pkt = validated + dst_offset; 490 void *src_pkt = unvalidated + src_offset; 491 u8 cmd = *(uint8_t *)src_pkt; 492 const struct cmd_info *info; 493 494 if (cmd >= ARRAY_SIZE(cmd_info)) { 495 DRM_ERROR("0x%08x: packet %d out of bounds\n", 496 src_offset, cmd); 497 return -EINVAL; 498 } 499 500 info = &cmd_info[cmd]; 501 if (!info->name) { 502 DRM_ERROR("0x%08x: packet %d invalid\n", 503 src_offset, cmd); 504 return -EINVAL; 505 } 506 507 if (src_offset + info->len > len) { 508 DRM_ERROR("0x%08x: packet %d (%s) length 0x%08x " 509 "exceeds bounds (0x%08x)\n", 510 src_offset, cmd, info->name, info->len, 511 src_offset + len); 512 return -EINVAL; 513 } 514 515 if (cmd != VC4_PACKET_GEM_HANDLES) 516 memcpy(dst_pkt, src_pkt, info->len); 517 518 if (info->func && info->func(exec, 519 dst_pkt + 1, 520 src_pkt + 1)) { 521 DRM_ERROR("0x%08x: packet %d (%s) failed to validate\n", 522 src_offset, cmd, info->name); 523 return -EINVAL; 524 } 525 526 src_offset += info->len; 527 /* GEM handle loading doesn't produce HW packets. */ 528 if (cmd != VC4_PACKET_GEM_HANDLES) 529 dst_offset += info->len; 530 531 /* When the CL hits halt, it'll stop reading anything else. */ 532 if (cmd == VC4_PACKET_HALT) 533 break; 534 } 535 536 exec->ct0ea = exec->ct0ca + dst_offset; 537 538 if (!exec->found_start_tile_binning_packet) { 539 DRM_ERROR("Bin CL missing VC4_PACKET_START_TILE_BINNING\n"); 540 return -EINVAL; 541 } 542 543 /* The bin CL must be ended with INCREMENT_SEMAPHORE and FLUSH. The 544 * semaphore is used to trigger the render CL to start up, and the 545 * FLUSH is what caps the bin lists with 546 * VC4_PACKET_RETURN_FROM_SUB_LIST (so they jump back to the main 547 * render CL when they get called to) and actually triggers the queued 548 * semaphore increment. 549 */ 550 if (!exec->found_increment_semaphore_packet || !exec->found_flush) { 551 DRM_ERROR("Bin CL missing VC4_PACKET_INCREMENT_SEMAPHORE + " 552 "VC4_PACKET_FLUSH\n"); 553 return -EINVAL; 554 } 555 556 return 0; 557 } 558 559 static bool 560 reloc_tex(struct vc4_exec_info *exec, 561 void *uniform_data_u, 562 struct vc4_texture_sample_info *sample, 563 uint32_t texture_handle_index, bool is_cs) 564 { 565 struct drm_gem_cma_object *tex; 566 uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]); 567 uint32_t p1 = *(uint32_t *)(uniform_data_u + sample->p_offset[1]); 568 uint32_t p2 = (sample->p_offset[2] != ~0 ? 569 *(uint32_t *)(uniform_data_u + sample->p_offset[2]) : 0); 570 uint32_t p3 = (sample->p_offset[3] != ~0 ? 571 *(uint32_t *)(uniform_data_u + sample->p_offset[3]) : 0); 572 uint32_t *validated_p0 = exec->uniforms_v + sample->p_offset[0]; 573 uint32_t offset = p0 & VC4_TEX_P0_OFFSET_MASK; 574 uint32_t miplevels = VC4_GET_FIELD(p0, VC4_TEX_P0_MIPLVLS); 575 uint32_t width = VC4_GET_FIELD(p1, VC4_TEX_P1_WIDTH); 576 uint32_t height = VC4_GET_FIELD(p1, VC4_TEX_P1_HEIGHT); 577 uint32_t cpp, tiling_format, utile_w, utile_h; 578 uint32_t i; 579 uint32_t cube_map_stride = 0; 580 enum vc4_texture_data_type type; 581 582 tex = vc4_use_bo(exec, texture_handle_index); 583 if (!tex) 584 return false; 585 586 if (sample->is_direct) { 587 uint32_t remaining_size = tex->base.size - p0; 588 589 if (p0 > tex->base.size - 4) { 590 DRM_ERROR("UBO offset greater than UBO size\n"); 591 goto fail; 592 } 593 if (p1 > remaining_size - 4) { 594 DRM_ERROR("UBO clamp would allow reads " 595 "outside of UBO\n"); 596 goto fail; 597 } 598 *validated_p0 = tex->paddr + p0; 599 return true; 600 } 601 602 if (width == 0) 603 width = 2048; 604 if (height == 0) 605 height = 2048; 606 607 if (p0 & VC4_TEX_P0_CMMODE_MASK) { 608 if (VC4_GET_FIELD(p2, VC4_TEX_P2_PTYPE) == 609 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) 610 cube_map_stride = p2 & VC4_TEX_P2_CMST_MASK; 611 if (VC4_GET_FIELD(p3, VC4_TEX_P2_PTYPE) == 612 VC4_TEX_P2_PTYPE_CUBE_MAP_STRIDE) { 613 if (cube_map_stride) { 614 DRM_ERROR("Cube map stride set twice\n"); 615 goto fail; 616 } 617 618 cube_map_stride = p3 & VC4_TEX_P2_CMST_MASK; 619 } 620 if (!cube_map_stride) { 621 DRM_ERROR("Cube map stride not set\n"); 622 goto fail; 623 } 624 } 625 626 type = (VC4_GET_FIELD(p0, VC4_TEX_P0_TYPE) | 627 (VC4_GET_FIELD(p1, VC4_TEX_P1_TYPE4) << 4)); 628 629 switch (type) { 630 case VC4_TEXTURE_TYPE_RGBA8888: 631 case VC4_TEXTURE_TYPE_RGBX8888: 632 case VC4_TEXTURE_TYPE_RGBA32R: 633 cpp = 4; 634 break; 635 case VC4_TEXTURE_TYPE_RGBA4444: 636 case VC4_TEXTURE_TYPE_RGBA5551: 637 case VC4_TEXTURE_TYPE_RGB565: 638 case VC4_TEXTURE_TYPE_LUMALPHA: 639 case VC4_TEXTURE_TYPE_S16F: 640 case VC4_TEXTURE_TYPE_S16: 641 cpp = 2; 642 break; 643 case VC4_TEXTURE_TYPE_LUMINANCE: 644 case VC4_TEXTURE_TYPE_ALPHA: 645 case VC4_TEXTURE_TYPE_S8: 646 cpp = 1; 647 break; 648 case VC4_TEXTURE_TYPE_ETC1: 649 /* ETC1 is arranged as 64-bit blocks, where each block is 4x4 650 * pixels. 651 */ 652 cpp = 8; 653 width = (width + 3) >> 2; 654 height = (height + 3) >> 2; 655 break; 656 case VC4_TEXTURE_TYPE_BW1: 657 case VC4_TEXTURE_TYPE_A4: 658 case VC4_TEXTURE_TYPE_A1: 659 case VC4_TEXTURE_TYPE_RGBA64: 660 case VC4_TEXTURE_TYPE_YUV422R: 661 default: 662 DRM_ERROR("Texture format %d unsupported\n", type); 663 goto fail; 664 } 665 utile_w = utile_width(cpp); 666 utile_h = utile_height(cpp); 667 668 if (type == VC4_TEXTURE_TYPE_RGBA32R) { 669 tiling_format = VC4_TILING_FORMAT_LINEAR; 670 } else { 671 if (size_is_lt(width, height, cpp)) 672 tiling_format = VC4_TILING_FORMAT_LT; 673 else 674 tiling_format = VC4_TILING_FORMAT_T; 675 } 676 677 if (!vc4_check_tex_size(exec, tex, offset + cube_map_stride * 5, 678 tiling_format, width, height, cpp)) { 679 goto fail; 680 } 681 682 /* The mipmap levels are stored before the base of the texture. Make 683 * sure there is actually space in the BO. 684 */ 685 for (i = 1; i <= miplevels; i++) { 686 uint32_t level_width = max(width >> i, 1u); 687 uint32_t level_height = max(height >> i, 1u); 688 uint32_t aligned_width, aligned_height; 689 uint32_t level_size; 690 691 /* Once the levels get small enough, they drop from T to LT. */ 692 if (tiling_format == VC4_TILING_FORMAT_T && 693 size_is_lt(level_width, level_height, cpp)) { 694 tiling_format = VC4_TILING_FORMAT_LT; 695 } 696 697 switch (tiling_format) { 698 case VC4_TILING_FORMAT_T: 699 aligned_width = round_up(level_width, utile_w * 8); 700 aligned_height = round_up(level_height, utile_h * 8); 701 break; 702 case VC4_TILING_FORMAT_LT: 703 aligned_width = round_up(level_width, utile_w); 704 aligned_height = round_up(level_height, utile_h); 705 break; 706 default: 707 aligned_width = round_up(level_width, utile_w); 708 aligned_height = level_height; 709 break; 710 } 711 712 level_size = aligned_width * cpp * aligned_height; 713 714 if (offset < level_size) { 715 DRM_ERROR("Level %d (%dx%d -> %dx%d) size %db " 716 "overflowed buffer bounds (offset %d)\n", 717 i, level_width, level_height, 718 aligned_width, aligned_height, 719 level_size, offset); 720 goto fail; 721 } 722 723 offset -= level_size; 724 } 725 726 *validated_p0 = tex->paddr + p0; 727 728 if (is_cs) { 729 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 730 to_vc4_bo(&tex->base)->write_seqno); 731 } 732 733 return true; 734 fail: 735 DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0); 736 DRM_INFO("Texture p1 at %d: 0x%08x\n", sample->p_offset[1], p1); 737 DRM_INFO("Texture p2 at %d: 0x%08x\n", sample->p_offset[2], p2); 738 DRM_INFO("Texture p3 at %d: 0x%08x\n", sample->p_offset[3], p3); 739 return false; 740 } 741 742 static int 743 validate_gl_shader_rec(struct drm_device *dev, 744 struct vc4_exec_info *exec, 745 struct vc4_shader_state *state) 746 { 747 uint32_t *src_handles; 748 void *pkt_u, *pkt_v; 749 static const uint32_t shader_reloc_offsets[] = { 750 4, /* fs */ 751 16, /* vs */ 752 28, /* cs */ 753 }; 754 uint32_t shader_reloc_count = ARRAY_SIZE(shader_reloc_offsets); 755 struct drm_gem_cma_object *bo[shader_reloc_count + 8]; 756 uint32_t nr_attributes, nr_relocs, packet_size; 757 int i; 758 759 nr_attributes = state->addr & 0x7; 760 if (nr_attributes == 0) 761 nr_attributes = 8; 762 packet_size = gl_shader_rec_size(state->addr); 763 764 nr_relocs = ARRAY_SIZE(shader_reloc_offsets) + nr_attributes; 765 if (nr_relocs * 4 > exec->shader_rec_size) { 766 DRM_ERROR("overflowed shader recs reading %d handles " 767 "from %d bytes left\n", 768 nr_relocs, exec->shader_rec_size); 769 return -EINVAL; 770 } 771 src_handles = exec->shader_rec_u; 772 exec->shader_rec_u += nr_relocs * 4; 773 exec->shader_rec_size -= nr_relocs * 4; 774 775 if (packet_size > exec->shader_rec_size) { 776 DRM_ERROR("overflowed shader recs copying %db packet " 777 "from %d bytes left\n", 778 packet_size, exec->shader_rec_size); 779 return -EINVAL; 780 } 781 pkt_u = exec->shader_rec_u; 782 pkt_v = exec->shader_rec_v; 783 memcpy(pkt_v, pkt_u, packet_size); 784 exec->shader_rec_u += packet_size; 785 /* Shader recs have to be aligned to 16 bytes (due to the attribute 786 * flags being in the low bytes), so round the next validated shader 787 * rec address up. This should be safe, since we've got so many 788 * relocations in a shader rec packet. 789 */ 790 BUG_ON(roundup(packet_size, 16) - packet_size > nr_relocs * 4); 791 exec->shader_rec_v += roundup(packet_size, 16); 792 exec->shader_rec_size -= packet_size; 793 794 for (i = 0; i < shader_reloc_count; i++) { 795 if (src_handles[i] > exec->bo_count) { 796 DRM_ERROR("Shader handle %d too big\n", src_handles[i]); 797 return -EINVAL; 798 } 799 800 bo[i] = exec->bo[src_handles[i]]; 801 if (!bo[i]) 802 return -EINVAL; 803 } 804 for (i = shader_reloc_count; i < nr_relocs; i++) { 805 bo[i] = vc4_use_bo(exec, src_handles[i]); 806 if (!bo[i]) 807 return -EINVAL; 808 } 809 810 if (((*(uint16_t *)pkt_u & VC4_SHADER_FLAG_FS_SINGLE_THREAD) == 0) != 811 to_vc4_bo(&bo[0]->base)->validated_shader->is_threaded) { 812 DRM_ERROR("Thread mode of CL and FS do not match\n"); 813 return -EINVAL; 814 } 815 816 if (to_vc4_bo(&bo[1]->base)->validated_shader->is_threaded || 817 to_vc4_bo(&bo[2]->base)->validated_shader->is_threaded) { 818 DRM_ERROR("cs and vs cannot be threaded\n"); 819 return -EINVAL; 820 } 821 822 for (i = 0; i < shader_reloc_count; i++) { 823 struct vc4_validated_shader_info *validated_shader; 824 uint32_t o = shader_reloc_offsets[i]; 825 uint32_t src_offset = *(uint32_t *)(pkt_u + o); 826 uint32_t *texture_handles_u; 827 void *uniform_data_u; 828 uint32_t tex, uni; 829 830 *(uint32_t *)(pkt_v + o) = bo[i]->paddr + src_offset; 831 832 if (src_offset != 0) { 833 DRM_ERROR("Shaders must be at offset 0 of " 834 "the BO.\n"); 835 return -EINVAL; 836 } 837 838 validated_shader = to_vc4_bo(&bo[i]->base)->validated_shader; 839 if (!validated_shader) 840 return -EINVAL; 841 842 if (validated_shader->uniforms_src_size > 843 exec->uniforms_size) { 844 DRM_ERROR("Uniforms src buffer overflow\n"); 845 return -EINVAL; 846 } 847 848 texture_handles_u = exec->uniforms_u; 849 uniform_data_u = (texture_handles_u + 850 validated_shader->num_texture_samples); 851 852 memcpy(exec->uniforms_v, uniform_data_u, 853 validated_shader->uniforms_size); 854 855 for (tex = 0; 856 tex < validated_shader->num_texture_samples; 857 tex++) { 858 if (!reloc_tex(exec, 859 uniform_data_u, 860 &validated_shader->texture_samples[tex], 861 texture_handles_u[tex], 862 i == 2)) { 863 return -EINVAL; 864 } 865 } 866 867 /* Fill in the uniform slots that need this shader's 868 * start-of-uniforms address (used for resetting the uniform 869 * stream in the presence of control flow). 870 */ 871 for (uni = 0; 872 uni < validated_shader->num_uniform_addr_offsets; 873 uni++) { 874 uint32_t o = validated_shader->uniform_addr_offsets[uni]; 875 ((uint32_t *)exec->uniforms_v)[o] = exec->uniforms_p; 876 } 877 878 *(uint32_t *)(pkt_v + o + 4) = exec->uniforms_p; 879 880 exec->uniforms_u += validated_shader->uniforms_src_size; 881 exec->uniforms_v += validated_shader->uniforms_size; 882 exec->uniforms_p += validated_shader->uniforms_size; 883 } 884 885 for (i = 0; i < nr_attributes; i++) { 886 struct drm_gem_cma_object *vbo = 887 bo[ARRAY_SIZE(shader_reloc_offsets) + i]; 888 uint32_t o = 36 + i * 8; 889 uint32_t offset = *(uint32_t *)(pkt_u + o + 0); 890 uint32_t attr_size = *(uint8_t *)(pkt_u + o + 4) + 1; 891 uint32_t stride = *(uint8_t *)(pkt_u + o + 5); 892 uint32_t max_index; 893 894 exec->bin_dep_seqno = max(exec->bin_dep_seqno, 895 to_vc4_bo(&vbo->base)->write_seqno); 896 897 if (state->addr & 0x8) 898 stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff; 899 900 if (vbo->base.size < offset || 901 vbo->base.size - offset < attr_size) { 902 DRM_ERROR("BO offset overflow (%d + %d > %zu)\n", 903 offset, attr_size, vbo->base.size); 904 return -EINVAL; 905 } 906 907 if (stride != 0) { 908 max_index = ((vbo->base.size - offset - attr_size) / 909 stride); 910 if (state->max_index > max_index) { 911 DRM_ERROR("primitives use index %d out of " 912 "supplied %d\n", 913 state->max_index, max_index); 914 return -EINVAL; 915 } 916 } 917 918 *(uint32_t *)(pkt_v + o) = vbo->paddr + offset; 919 } 920 921 return 0; 922 } 923 924 int 925 vc4_validate_shader_recs(struct drm_device *dev, 926 struct vc4_exec_info *exec) 927 { 928 uint32_t i; 929 int ret = 0; 930 931 for (i = 0; i < exec->shader_state_count; i++) { 932 ret = validate_gl_shader_rec(dev, exec, &exec->shader_state[i]); 933 if (ret) 934 return ret; 935 } 936 937 return ret; 938 } 939