2 * Copyright © 2014 Broadcom
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
25 * DOC: Shader validator for VC4.
27 * The VC4 has no IOMMU between it and system memory, so a user with
28 * access to execute shaders could escalate privilege by overwriting
29 * system memory (using the VPM write address register in the
30 * general-purpose DMA mode) or reading system memory it shouldn't
31 * (reading it as a texture, or uniform data, or vertex data).
33 * This walks over a shader BO, ensuring that its accesses are
34 * appropriately bounded, and recording how many texture accesses are
35 * made and where so that we can do relocations for them in the
40 #include "vc4_qpu_defines.h"
42 #define LIVE_REG_COUNT (32 + 32 + 4)
44 struct vc4_shader_validation_state {
45 /* Current IP being validated. */
48 /* IP at the end of the BO, do not read shader[max_ip] */
53 struct vc4_texture_sample_info tmu_setup[2];
54 int tmu_write_count[2];
56 /* For registers that were last written to by a MIN instruction with
57 * one argument being a uniform, the address of the uniform.
60 * This is used for the validation of direct address memory reads.
62 uint32_t live_min_clamp_offsets[LIVE_REG_COUNT];
63 bool live_max_clamp_regs[LIVE_REG_COUNT];
64 uint32_t live_immediates[LIVE_REG_COUNT];
66 /* Bitfield of which IPs are used as branch targets.
68 * Used for validation that the uniform stream is updated at the right
69 * points and clearing the texturing/clamping state.
71 unsigned long *branch_targets;
73 /* Set when entering a basic block, and cleared when the uniform
74 * address update is found. This is used to make sure that we don't
75 * read uniforms when the address is undefined.
77 bool needs_uniform_address_update;
79 /* Set when we find a backwards branch. If the branch is backwards,
80 * the taraget is probably doing an address reset to read uniforms,
81 * and so we need to be sure that a uniforms address is present in the
82 * stream, even if the shader didn't need to read uniforms in later
85 bool needs_uniform_address_for_loop;
89 waddr_to_live_reg_index(uint32_t waddr, bool is_b)
96 } else if (waddr <= QPU_W_ACC3) {
97 return 64 + waddr - QPU_W_ACC0;
104 raddr_add_a_to_live_reg_index(uint64_t inst)
106 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
107 uint32_t add_a = QPU_GET_FIELD(inst, QPU_ADD_A);
108 uint32_t raddr_a = QPU_GET_FIELD(inst, QPU_RADDR_A);
109 uint32_t raddr_b = QPU_GET_FIELD(inst, QPU_RADDR_B);
111 if (add_a == QPU_MUX_A)
113 else if (add_a == QPU_MUX_B && sig != QPU_SIG_SMALL_IMM)
115 else if (add_a <= QPU_MUX_R3)
122 is_tmu_submit(uint32_t waddr)
124 return (waddr == QPU_W_TMU0_S ||
125 waddr == QPU_W_TMU1_S);
129 is_tmu_write(uint32_t waddr)
131 return (waddr >= QPU_W_TMU0_S &&
132 waddr <= QPU_W_TMU1_B);
136 record_texture_sample(struct vc4_validated_shader_info *validated_shader,
137 struct vc4_shader_validation_state *validation_state,
140 uint32_t s = validated_shader->num_texture_samples;
142 struct vc4_texture_sample_info *temp_samples;
144 temp_samples = krealloc(validated_shader->texture_samples,
145 (s + 1) * sizeof(*temp_samples),
150 memcpy(&temp_samples[s],
151 &validation_state->tmu_setup[tmu],
152 sizeof(*temp_samples));
154 validated_shader->num_texture_samples = s + 1;
155 validated_shader->texture_samples = temp_samples;
157 for (i = 0; i < 4; i++)
158 validation_state->tmu_setup[tmu].p_offset[i] = ~0;
164 check_tmu_write(struct vc4_validated_shader_info *validated_shader,
165 struct vc4_shader_validation_state *validation_state,
168 uint64_t inst = validation_state->shader[validation_state->ip];
169 uint32_t waddr = (is_mul ?
170 QPU_GET_FIELD(inst, QPU_WADDR_MUL) :
171 QPU_GET_FIELD(inst, QPU_WADDR_ADD));
172 uint32_t raddr_a = QPU_GET_FIELD(inst, QPU_RADDR_A);
173 uint32_t raddr_b = QPU_GET_FIELD(inst, QPU_RADDR_B);
174 int tmu = waddr > QPU_W_TMU0_B;
175 bool submit = is_tmu_submit(waddr);
176 bool is_direct = submit && validation_state->tmu_write_count[tmu] == 0;
177 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
180 uint32_t add_b = QPU_GET_FIELD(inst, QPU_ADD_B);
181 uint32_t clamp_reg, clamp_offset;
183 if (sig == QPU_SIG_SMALL_IMM) {
184 DRM_ERROR("direct TMU read used small immediate\n");
188 /* Make sure that this texture load is an add of the base
189 * address of the UBO to a clamped offset within the UBO.
192 QPU_GET_FIELD(inst, QPU_OP_ADD) != QPU_A_ADD) {
193 DRM_ERROR("direct TMU load wasn't an add\n");
197 /* We assert that the clamped address is the first
198 * argument, and the UBO base address is the second argument.
199 * This is arbitrary, but simpler than supporting flipping the
202 clamp_reg = raddr_add_a_to_live_reg_index(inst);
203 if (clamp_reg == ~0) {
204 DRM_ERROR("direct TMU load wasn't clamped\n");
208 clamp_offset = validation_state->live_min_clamp_offsets[clamp_reg];
209 if (clamp_offset == ~0) {
210 DRM_ERROR("direct TMU load wasn't clamped\n");
214 /* Store the clamp value's offset in p1 (see reloc_tex() in
217 validation_state->tmu_setup[tmu].p_offset[1] =
220 if (!(add_b == QPU_MUX_A && raddr_a == QPU_R_UNIF) &&
221 !(add_b == QPU_MUX_B && raddr_b == QPU_R_UNIF)) {
222 DRM_ERROR("direct TMU load didn't add to a uniform\n");
226 validation_state->tmu_setup[tmu].is_direct = true;
228 if (raddr_a == QPU_R_UNIF || (sig != QPU_SIG_SMALL_IMM &&
229 raddr_b == QPU_R_UNIF)) {
230 DRM_ERROR("uniform read in the same instruction as "
236 if (validation_state->tmu_write_count[tmu] >= 4) {
237 DRM_ERROR("TMU%d got too many parameters before dispatch\n",
241 validation_state->tmu_setup[tmu].p_offset[validation_state->tmu_write_count[tmu]] =
242 validated_shader->uniforms_size;
243 validation_state->tmu_write_count[tmu]++;
244 /* Since direct uses a RADDR uniform reference, it will get counted in
245 * check_instruction_reads()
248 if (validation_state->needs_uniform_address_update) {
249 DRM_ERROR("Texturing with undefined uniform address\n");
253 validated_shader->uniforms_size += 4;
257 if (!record_texture_sample(validated_shader,
258 validation_state, tmu)) {
262 validation_state->tmu_write_count[tmu] = 0;
268 static bool require_uniform_address_uniform(struct vc4_validated_shader_info *validated_shader)
270 uint32_t o = validated_shader->num_uniform_addr_offsets;
271 uint32_t num_uniforms = validated_shader->uniforms_size / 4;
273 validated_shader->uniform_addr_offsets =
274 krealloc(validated_shader->uniform_addr_offsets,
276 sizeof(*validated_shader->uniform_addr_offsets),
278 if (!validated_shader->uniform_addr_offsets)
281 validated_shader->uniform_addr_offsets[o] = num_uniforms;
282 validated_shader->num_uniform_addr_offsets++;
288 validate_uniform_address_write(struct vc4_validated_shader_info *validated_shader,
289 struct vc4_shader_validation_state *validation_state,
292 uint64_t inst = validation_state->shader[validation_state->ip];
293 u32 add_b = QPU_GET_FIELD(inst, QPU_ADD_B);
294 u32 raddr_a = QPU_GET_FIELD(inst, QPU_RADDR_A);
295 u32 raddr_b = QPU_GET_FIELD(inst, QPU_RADDR_B);
296 u32 add_lri = raddr_add_a_to_live_reg_index(inst);
297 /* We want our reset to be pointing at whatever uniform follows the
298 * uniforms base address.
300 u32 expected_offset = validated_shader->uniforms_size + 4;
302 /* We only support absolute uniform address changes, and we
303 * require that they be in the current basic block before any
304 * of its uniform reads.
306 * One could potentially emit more efficient QPU code, by
307 * noticing that (say) an if statement does uniform control
308 * flow for all threads and that the if reads the same number
309 * of uniforms on each side. However, this scheme is easy to
310 * validate so it's all we allow for now.
312 switch (QPU_GET_FIELD(inst, QPU_SIG)) {
314 case QPU_SIG_SCOREBOARD_UNLOCK:
315 case QPU_SIG_COLOR_LOAD:
316 case QPU_SIG_LOAD_TMU0:
317 case QPU_SIG_LOAD_TMU1:
320 DRM_ERROR("uniforms address change must be "
325 if (is_mul || QPU_GET_FIELD(inst, QPU_OP_ADD) != QPU_A_ADD) {
326 DRM_ERROR("Uniform address reset must be an ADD.\n");
330 if (QPU_GET_FIELD(inst, QPU_COND_ADD) != QPU_COND_ALWAYS) {
331 DRM_ERROR("Uniform address reset must be unconditional.\n");
335 if (QPU_GET_FIELD(inst, QPU_PACK) != QPU_PACK_A_NOP &&
337 DRM_ERROR("No packing allowed on uniforms reset\n");
342 DRM_ERROR("First argument of uniform address write must be "
343 "an immediate value.\n");
347 if (validation_state->live_immediates[add_lri] != expected_offset) {
348 DRM_ERROR("Resetting uniforms with offset %db instead of %db\n",
349 validation_state->live_immediates[add_lri],
354 if (!(add_b == QPU_MUX_A && raddr_a == QPU_R_UNIF) &&
355 !(add_b == QPU_MUX_B && raddr_b == QPU_R_UNIF)) {
356 DRM_ERROR("Second argument of uniform address write must be "
361 validation_state->needs_uniform_address_update = false;
362 validation_state->needs_uniform_address_for_loop = false;
363 return require_uniform_address_uniform(validated_shader);
367 check_reg_write(struct vc4_validated_shader_info *validated_shader,
368 struct vc4_shader_validation_state *validation_state,
371 uint64_t inst = validation_state->shader[validation_state->ip];
372 uint32_t waddr = (is_mul ?
373 QPU_GET_FIELD(inst, QPU_WADDR_MUL) :
374 QPU_GET_FIELD(inst, QPU_WADDR_ADD));
375 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
376 bool ws = inst & QPU_WS;
377 bool is_b = is_mul ^ ws;
378 u32 lri = waddr_to_live_reg_index(waddr, is_b);
381 uint32_t cond_add = QPU_GET_FIELD(inst, QPU_COND_ADD);
382 uint32_t cond_mul = QPU_GET_FIELD(inst, QPU_COND_MUL);
384 if (sig == QPU_SIG_LOAD_IMM &&
385 QPU_GET_FIELD(inst, QPU_PACK) == QPU_PACK_A_NOP &&
386 ((is_mul && cond_mul == QPU_COND_ALWAYS) ||
387 (!is_mul && cond_add == QPU_COND_ALWAYS))) {
388 validation_state->live_immediates[lri] =
389 QPU_GET_FIELD(inst, QPU_LOAD_IMM);
391 validation_state->live_immediates[lri] = ~0;
396 case QPU_W_UNIFORMS_ADDRESS:
398 DRM_ERROR("relative uniforms address change "
403 return validate_uniform_address_write(validated_shader,
407 case QPU_W_TLB_COLOR_MS:
408 case QPU_W_TLB_COLOR_ALL:
410 /* These only interact with the tile buffer, not main memory,
423 return check_tmu_write(validated_shader, validation_state,
427 case QPU_W_TMU_NOSWAP:
428 case QPU_W_TLB_ALPHA_MASK:
429 case QPU_W_MUTEX_RELEASE:
430 /* XXX: I haven't thought about these, so don't support them
433 DRM_ERROR("Unsupported waddr %d\n", waddr);
437 DRM_ERROR("General VPM DMA unsupported\n");
441 case QPU_W_VPMVCD_SETUP:
442 /* We allow VPM setup in general, even including VPM DMA
443 * configuration setup, because the (unsafe) DMA can only be
444 * triggered by QPU_W_VPM_ADDR writes.
448 case QPU_W_TLB_STENCIL_SETUP:
456 track_live_clamps(struct vc4_validated_shader_info *validated_shader,
457 struct vc4_shader_validation_state *validation_state)
459 uint64_t inst = validation_state->shader[validation_state->ip];
460 uint32_t op_add = QPU_GET_FIELD(inst, QPU_OP_ADD);
461 uint32_t waddr_add = QPU_GET_FIELD(inst, QPU_WADDR_ADD);
462 uint32_t waddr_mul = QPU_GET_FIELD(inst, QPU_WADDR_MUL);
463 uint32_t cond_add = QPU_GET_FIELD(inst, QPU_COND_ADD);
464 uint32_t add_a = QPU_GET_FIELD(inst, QPU_ADD_A);
465 uint32_t add_b = QPU_GET_FIELD(inst, QPU_ADD_B);
466 uint32_t raddr_a = QPU_GET_FIELD(inst, QPU_RADDR_A);
467 uint32_t raddr_b = QPU_GET_FIELD(inst, QPU_RADDR_B);
468 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
469 bool ws = inst & QPU_WS;
470 uint32_t lri_add_a, lri_add, lri_mul;
473 /* Check whether OP_ADD's A argumennt comes from a live MAX(x, 0),
474 * before we clear previous live state.
476 lri_add_a = raddr_add_a_to_live_reg_index(inst);
477 add_a_is_min_0 = (lri_add_a != ~0 &&
478 validation_state->live_max_clamp_regs[lri_add_a]);
480 /* Clear live state for registers written by our instruction. */
481 lri_add = waddr_to_live_reg_index(waddr_add, ws);
482 lri_mul = waddr_to_live_reg_index(waddr_mul, !ws);
484 validation_state->live_max_clamp_regs[lri_mul] = false;
485 validation_state->live_min_clamp_offsets[lri_mul] = ~0;
488 validation_state->live_max_clamp_regs[lri_add] = false;
489 validation_state->live_min_clamp_offsets[lri_add] = ~0;
491 /* Nothing further to do for live tracking, since only ADDs
492 * generate new live clamp registers.
497 /* Now, handle remaining live clamp tracking for the ADD operation. */
499 if (cond_add != QPU_COND_ALWAYS)
502 if (op_add == QPU_A_MAX) {
503 /* Track live clamps of a value to a minimum of 0 (in either
506 if (sig != QPU_SIG_SMALL_IMM || raddr_b != 0 ||
507 (add_a != QPU_MUX_B && add_b != QPU_MUX_B)) {
511 validation_state->live_max_clamp_regs[lri_add] = true;
512 } else if (op_add == QPU_A_MIN) {
513 /* Track live clamps of a value clamped to a minimum of 0 and
514 * a maximum of some uniform's offset.
519 if (!(add_b == QPU_MUX_A && raddr_a == QPU_R_UNIF) &&
520 !(add_b == QPU_MUX_B && raddr_b == QPU_R_UNIF &&
521 sig != QPU_SIG_SMALL_IMM)) {
525 validation_state->live_min_clamp_offsets[lri_add] =
526 validated_shader->uniforms_size;
531 check_instruction_writes(struct vc4_validated_shader_info *validated_shader,
532 struct vc4_shader_validation_state *validation_state)
534 uint64_t inst = validation_state->shader[validation_state->ip];
535 uint32_t waddr_add = QPU_GET_FIELD(inst, QPU_WADDR_ADD);
536 uint32_t waddr_mul = QPU_GET_FIELD(inst, QPU_WADDR_MUL);
539 if (is_tmu_write(waddr_add) && is_tmu_write(waddr_mul)) {
540 DRM_ERROR("ADD and MUL both set up textures\n");
544 ok = (check_reg_write(validated_shader, validation_state, false) &&
545 check_reg_write(validated_shader, validation_state, true));
547 track_live_clamps(validated_shader, validation_state);
553 check_branch(uint64_t inst,
554 struct vc4_validated_shader_info *validated_shader,
555 struct vc4_shader_validation_state *validation_state,
558 int32_t branch_imm = QPU_GET_FIELD(inst, QPU_BRANCH_TARGET);
559 uint32_t waddr_add = QPU_GET_FIELD(inst, QPU_WADDR_ADD);
560 uint32_t waddr_mul = QPU_GET_FIELD(inst, QPU_WADDR_MUL);
562 if ((int)branch_imm < 0)
563 validation_state->needs_uniform_address_for_loop = true;
565 /* We don't want to have to worry about validation of this, and
566 * there's no need for it.
568 if (waddr_add != QPU_W_NOP || waddr_mul != QPU_W_NOP) {
569 DRM_ERROR("branch instruction at %d wrote a register.\n",
570 validation_state->ip);
578 check_instruction_reads(struct vc4_validated_shader_info *validated_shader,
579 struct vc4_shader_validation_state *validation_state)
581 uint64_t inst = validation_state->shader[validation_state->ip];
582 uint32_t raddr_a = QPU_GET_FIELD(inst, QPU_RADDR_A);
583 uint32_t raddr_b = QPU_GET_FIELD(inst, QPU_RADDR_B);
584 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
586 if (raddr_a == QPU_R_UNIF ||
587 (raddr_b == QPU_R_UNIF && sig != QPU_SIG_SMALL_IMM)) {
588 /* This can't overflow the uint32_t, because we're reading 8
589 * bytes of instruction to increment by 4 here, so we'd
592 validated_shader->uniforms_size += 4;
594 if (validation_state->needs_uniform_address_update) {
595 DRM_ERROR("Uniform read with undefined uniform "
604 /* Make sure that all branches are absolute and point within the shader, and
605 * note their targets for later.
608 vc4_validate_branches(struct vc4_shader_validation_state *validation_state)
610 uint32_t max_branch_target = 0;
612 int last_branch = -2;
614 for (ip = 0; ip < validation_state->max_ip; ip++) {
615 uint64_t inst = validation_state->shader[ip];
616 int32_t branch_imm = QPU_GET_FIELD(inst, QPU_BRANCH_TARGET);
617 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
618 uint32_t after_delay_ip = ip + 4;
619 uint32_t branch_target_ip;
621 if (sig == QPU_SIG_PROG_END) {
622 /* There are two delay slots after program end is
623 * signaled that are still executed, then we're
624 * finished. validation_state->max_ip is the
625 * instruction after the last valid instruction in the
628 validation_state->max_ip = ip + 3;
632 if (sig != QPU_SIG_BRANCH)
635 if (ip - last_branch < 4) {
636 DRM_ERROR("Branch at %d during delay slots\n", ip);
641 if (inst & QPU_BRANCH_REG) {
642 DRM_ERROR("branching from register relative "
647 if (!(inst & QPU_BRANCH_REL)) {
648 DRM_ERROR("relative branching required\n");
652 /* The actual branch target is the instruction after the delay
653 * slots, plus whatever byte offset is in the low 32 bits of
654 * the instruction. Make sure we're not branching beyond the
655 * end of the shader object.
657 if (branch_imm % sizeof(inst) != 0) {
658 DRM_ERROR("branch target not aligned\n");
662 branch_target_ip = after_delay_ip + (branch_imm >> 3);
663 if (branch_target_ip >= validation_state->max_ip) {
664 DRM_ERROR("Branch at %d outside of shader (ip %d/%d)\n",
665 ip, branch_target_ip,
666 validation_state->max_ip);
669 set_bit(branch_target_ip, validation_state->branch_targets);
671 /* Make sure that the non-branching path is also not outside
674 if (after_delay_ip >= validation_state->max_ip) {
675 DRM_ERROR("Branch at %d continues past shader end "
677 ip, after_delay_ip, validation_state->max_ip);
680 set_bit(after_delay_ip, validation_state->branch_targets);
681 max_branch_target = max(max_branch_target, after_delay_ip);
684 if (max_branch_target > validation_state->max_ip - 3) {
685 DRM_ERROR("Branch landed after QPU_SIG_PROG_END");
692 /* Resets any known state for the shader, used when we may be branched to from
693 * multiple locations in the program (or at shader start).
696 reset_validation_state(struct vc4_shader_validation_state *validation_state)
700 for (i = 0; i < 8; i++)
701 validation_state->tmu_setup[i / 4].p_offset[i % 4] = ~0;
703 for (i = 0; i < LIVE_REG_COUNT; i++) {
704 validation_state->live_min_clamp_offsets[i] = ~0;
705 validation_state->live_max_clamp_regs[i] = false;
706 validation_state->live_immediates[i] = ~0;
711 texturing_in_progress(struct vc4_shader_validation_state *validation_state)
713 return (validation_state->tmu_write_count[0] != 0 ||
714 validation_state->tmu_write_count[1] != 0);
718 vc4_handle_branch_target(struct vc4_shader_validation_state *validation_state)
720 uint32_t ip = validation_state->ip;
722 if (!test_bit(ip, validation_state->branch_targets))
725 if (texturing_in_progress(validation_state)) {
726 DRM_ERROR("Branch target landed during TMU setup\n");
730 /* Reset our live values tracking, since this instruction may have
731 * multiple predecessors.
733 * One could potentially do analysis to determine that, for
734 * example, all predecessors have a live max clamp in the same
735 * register, but we don't bother with that.
737 reset_validation_state(validation_state);
739 /* Since we've entered a basic block from potentially multiple
740 * predecessors, we need the uniforms address to be updated before any
741 * unforms are read. We require that after any branch point, the next
742 * uniform to be loaded is a uniform address offset. That uniform's
743 * offset will be marked by the uniform address register write
744 * validation, or a one-off the end-of-program check.
746 validation_state->needs_uniform_address_update = true;
751 struct vc4_validated_shader_info *
752 vc4_validate_shader(struct drm_gem_cma_object *shader_obj)
754 bool found_shader_end = false;
755 int shader_end_ip = 0;
757 struct vc4_validated_shader_info *validated_shader = NULL;
758 struct vc4_shader_validation_state validation_state;
760 memset(&validation_state, 0, sizeof(validation_state));
761 validation_state.shader = shader_obj->vaddr;
762 validation_state.max_ip = shader_obj->base.size / sizeof(uint64_t);
764 reset_validation_state(&validation_state);
766 validation_state.branch_targets =
767 kcalloc(BITS_TO_LONGS(validation_state.max_ip),
768 sizeof(unsigned long), GFP_KERNEL);
769 if (!validation_state.branch_targets)
772 validated_shader = kcalloc(1, sizeof(*validated_shader), GFP_KERNEL);
773 if (!validated_shader)
776 if (!vc4_validate_branches(&validation_state))
779 for (ip = 0; ip < validation_state.max_ip; ip++) {
780 uint64_t inst = validation_state.shader[ip];
781 uint32_t sig = QPU_GET_FIELD(inst, QPU_SIG);
783 validation_state.ip = ip;
785 if (!vc4_handle_branch_target(&validation_state))
790 case QPU_SIG_WAIT_FOR_SCOREBOARD:
791 case QPU_SIG_SCOREBOARD_UNLOCK:
792 case QPU_SIG_COLOR_LOAD:
793 case QPU_SIG_LOAD_TMU0:
794 case QPU_SIG_LOAD_TMU1:
795 case QPU_SIG_PROG_END:
796 case QPU_SIG_SMALL_IMM:
797 if (!check_instruction_writes(validated_shader,
798 &validation_state)) {
799 DRM_ERROR("Bad write at ip %d\n", ip);
803 if (!check_instruction_reads(validated_shader,
807 if (sig == QPU_SIG_PROG_END) {
808 found_shader_end = true;
814 case QPU_SIG_LOAD_IMM:
815 if (!check_instruction_writes(validated_shader,
816 &validation_state)) {
817 DRM_ERROR("Bad LOAD_IMM write at ip %d\n", ip);
823 if (!check_branch(inst, validated_shader,
824 &validation_state, ip))
828 DRM_ERROR("Unsupported QPU signal %d at "
829 "instruction %d\n", sig, ip);
833 /* There are two delay slots after program end is signaled
834 * that are still executed, then we're finished.
836 if (found_shader_end && ip == shader_end_ip + 2)
840 if (ip == validation_state.max_ip) {
841 DRM_ERROR("shader failed to terminate before "
842 "shader BO end at %zd\n",
843 shader_obj->base.size);
847 /* If we did a backwards branch and we haven't emitted a uniforms
848 * reset since then, we still need the uniforms stream to have the
849 * uniforms address available so that the backwards branch can do its
852 * We could potentially prove that the backwards branch doesn't
853 * contain any uses of uniforms until program exit, but that doesn't
854 * seem to be worth the trouble.
856 if (validation_state.needs_uniform_address_for_loop) {
857 if (!require_uniform_address_uniform(validated_shader))
859 validated_shader->uniforms_size += 4;
862 /* Again, no chance of integer overflow here because the worst case
863 * scenario is 8 bytes of uniforms plus handles per 8-byte
866 validated_shader->uniforms_src_size =
867 (validated_shader->uniforms_size +
868 4 * validated_shader->num_texture_samples);
870 kfree(validation_state.branch_targets);
872 return validated_shader;
875 kfree(validation_state.branch_targets);
876 if (validated_shader) {
877 kfree(validated_shader->texture_samples);
878 kfree(validated_shader);