target/linux/brcm2708/patches-4.4/0537-drm-vc4-Fix-termination-of-the-initial-scan-for-bran.patch

   1 From 1f42fbc79dea3529dd919249ee6e58f157704aaf Mon Sep 17 00:00:00 2001
   2 From: Eric Anholt <eric@anholt.net>
   3 Date: Thu, 20 Oct 2016 16:48:12 -0700
   4 Subject: [PATCH] drm/vc4: Fix termination of the initial scan for branch
   5  targets.
   6
   7 The loop is scanning until the original max_ip (size of the BO), but
   8 we want to not examine any code after the PROG_END's delay slots.
   9 There was a block trying to do that, except that we had some early
  10 continue statements if the signal wasn't a PROG_END or a BRANCH.
  11
  12 The failure mode would be that a valid shader is rejected because some
  13 undefined memory after the PROG_END slots is parsed as a branch and
  14 the rest of its setup is illegal.  I haven't seen this in the wild,
  15 but valgrind was complaining when about this up in the userland
  16 simulator mode.
  17
  18 Signed-off-by: Eric Anholt <eric@anholt.net>
  19 (cherry picked from commit 457e67a728696c4f8e6423c64e93def50530db9a)
  20 ---
  21  drivers/gpu/drm/vc4/vc4_validate_shaders.c | 19 ++++++++-----------
  22  1 file changed, 8 insertions(+), 11 deletions(-)
  23
  24 --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
  25 +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
  26 @@ -608,9 +608,7 @@ static bool
  27  vc4_validate_branches(struct vc4_shader_validation_state *validation_state)
  28  {
  29         uint32_t max_branch_target = 0;
  30 -       bool found_shader_end = false;
  31         int ip;
  32 -       int shader_end_ip = 0;
  33         int last_branch = -2;
  34
  35         for (ip = 0; ip < validation_state->max_ip; ip++) {
  36 @@ -621,8 +619,13 @@ vc4_validate_branches(struct vc4_shader_
  37                 uint32_t branch_target_ip;
  38
  39                 if (sig == QPU_SIG_PROG_END) {
  40 -                       shader_end_ip = ip;
  41 -                       found_shader_end = true;
  42 +                       /* There are two delay slots after program end is
  43 +                        * signaled that are still executed, then we're
  44 +                        * finished.  validation_state->max_ip is the
  45 +                        * instruction after the last valid instruction in the
  46 +                        * program.
  47 +                        */
  48 +                       validation_state->max_ip = ip + 3;
  49                         continue;
  50                 }
  51
  52 @@ -676,15 +679,9 @@ vc4_validate_branches(struct vc4_shader_
  53                 }
  54                 set_bit(after_delay_ip, validation_state->branch_targets);
  55                 max_branch_target = max(max_branch_target, after_delay_ip);
  56 -
  57 -               /* There are two delay slots after program end is signaled
  58 -                * that are still executed, then we're finished.
  59 -                */
  60 -               if (found_shader_end && ip == shader_end_ip + 2)
  61 -                       break;
  62         }
  63
  64 -       if (max_branch_target > shader_end_ip) {
  65 +       if (max_branch_target > validation_state->max_ip - 3) {
  66                 DRM_ERROR("Branch landed after QPU_SIG_PROG_END");
  67                 return false;
  68         }