pan/decode: Verify and omit polygon size

[mesa.git] / src / panfrost / pandecode / decode.c

diff --git a/src/panfrost/pandecode/decode.c b/src/panfrost/pandecode/decode.c
index 0e8172745d3b2f5e4b92d4b12f3ba3441c507b16..17f974ef33e0a3a8f5a158f25ce15fcd92af424d 100644 (file)
--- a/src/panfrost/pandecode/decode.c
+++ b/src/panfrost/pandecode/decode.c
@@ -476,30 +476,61 @@ pandecode_exception_access(enum mali_exception_access fmt)
  * larger FBD */
 
 static void
-pandecode_midgard_tiler_descriptor(const struct midgard_tiler_descriptor *t)
+pandecode_midgard_tiler_descriptor(
+                const struct midgard_tiler_descriptor *t,
+                unsigned width,
+                unsigned height)
 {
         pandecode_log(".tiler = {\n");
         pandecode_indent++;
 
         pandecode_prop("hierarchy_mask = 0x%" PRIx16, t->hierarchy_mask);
         pandecode_prop("flags = 0x%" PRIx16, t->flags);
-        pandecode_prop("polygon_list_size = 0x%x", t->polygon_list_size);
 
         MEMORY_PROP(t, polygon_list);
-        MEMORY_PROP(t, polygon_list_body);
 
-        MEMORY_PROP(t, heap_start);
+        /* The body is offset from the base of the polygon list */
+        assert(t->polygon_list_body > t->polygon_list);
+        unsigned body_offset = t->polygon_list_body - t->polygon_list;
 
-        if (t->heap_start == t->heap_end) {
-              /* Print identically to show symmetry for empty tiler heaps */  
-                MEMORY_PROP(t, heap_end);
-        } else {
-                /* Points to the end of a buffer */
-                char *a = pointer_as_memory_reference(t->heap_end - 1);
-                pandecode_prop("heap_end = %s + 1", a);
-                free(a);
+        /* It needs to fit inside the reported size */
+        assert(t->polygon_list_size >= body_offset);
+
+        /* Check that we fit */
+        struct pandecode_mapped_memory *plist =
+                pandecode_find_mapped_gpu_mem_containing(t->polygon_list);
+
+        assert(t->polygon_list_size <= plist->length);
+
+        /* Now that we've sanity checked, we'll try to calculate the sizes
+         * ourselves for comparison */
+
+        unsigned ref_header = panfrost_tiler_header_size(width, height, t->hierarchy_mask);
+        unsigned ref_body = panfrost_tiler_body_size(width, height, t->hierarchy_mask);
+        unsigned ref_size = ref_header + ref_body;
+
+        if (!((ref_header == body_offset) && (ref_size == t->polygon_list_size))) {
+                pandecode_msg("XXX: bad polygon list size (expected %d / 0x%x)\n",
+                                ref_header, ref_size);
+                pandecode_prop("polygon_list_size = 0x%x", t->polygon_list_size);
+                pandecode_msg("body offset %d\n", body_offset);
         }
 
+        /* The tiler heap has a start and end specified, so check that
+         * everything fits in a contiguous BO (otherwise, we risk out-of-bounds
+         * reads) */
+
+        MEMORY_PROP(t, heap_start);
+        assert(t->heap_end >= t->heap_start);
+
+        struct pandecode_mapped_memory *heap =
+                pandecode_find_mapped_gpu_mem_containing(t->heap_start);
+
+        unsigned heap_size = t->heap_end - t->heap_start;
+        assert(heap_size <= heap->length);
+
+        pandecode_msg("heap size %d\n", heap_size);
+
         bool nonzero_weights = false;
 
         for (unsigned w = 0; w < ARRAY_SIZE(t->weights); ++w) {
@@ -579,7 +610,7 @@ pandecode_sfbd(uint64_t gpu_va, int job_no)
 
         MEMORY_PROP(s, unknown_address_0);
         const struct midgard_tiler_descriptor t = s->tiler;
-        pandecode_midgard_tiler_descriptor(&t);
+        pandecode_midgard_tiler_descriptor(&t, s->width + 1, s->height + 1);
 
         pandecode_indent--;
         pandecode_log("};\n");
@@ -808,7 +839,7 @@ pandecode_mfbd_bfr(uint64_t gpu_va, int job_no, bool with_render_targets)
         pandecode_prop("unknown2 = 0x%x", fb->unknown2);
         MEMORY_PROP(fb, scratchpad);
         const struct midgard_tiler_descriptor t = fb->tiler;
-        pandecode_midgard_tiler_descriptor(&t);
+        pandecode_midgard_tiler_descriptor(&t, fb->width1 + 1, fb->height1 + 1);
 
         if (fb->zero3 || fb->zero4) {
                 pandecode_msg("framebuffer zeros tripped\n");
@@ -1348,7 +1379,8 @@ pandecode_vertex_tiler_prefix(struct mali_vertex_tiler_prefix *p, int job_no, bo
                 (p->size_z_shift == ref.size_z_shift) &&
                 (p->workgroups_x_shift == ref.workgroups_x_shift) &&
                 (p->workgroups_y_shift == ref.workgroups_y_shift) &&
-                (p->workgroups_z_shift == ref.workgroups_z_shift);
+                (p->workgroups_z_shift == ref.workgroups_z_shift) &&
+                (p->workgroups_x_shift_2 == ref.workgroups_x_shift_2);
 
         if (!canonical) {
                 pandecode_msg("XXX: non-canonical workgroups packing\n");
@@ -1358,7 +1390,8 @@ pandecode_vertex_tiler_prefix(struct mali_vertex_tiler_prefix *p, int job_no, bo
                                 ref.size_z_shift,
                                 ref.workgroups_x_shift,
                                 ref.workgroups_y_shift,
-                                ref.workgroups_z_shift);
+                                ref.workgroups_z_shift,
+                                ref.workgroups_x_shift_2);
 
                 pandecode_prop("invocation_count = 0x%" PRIx32, p->invocation_count);
                 pandecode_prop("size_y_shift = %d", p->size_y_shift);
@@ -1366,6 +1399,7 @@ pandecode_vertex_tiler_prefix(struct mali_vertex_tiler_prefix *p, int job_no, bo
                 pandecode_prop("workgroups_x_shift = %d", p->workgroups_x_shift);
                 pandecode_prop("workgroups_y_shift = %d", p->workgroups_y_shift);
                 pandecode_prop("workgroups_z_shift = %d", p->workgroups_z_shift);
+                pandecode_prop("workgroups_x_shift_2 = %d", p->workgroups_x_shift_2);
         }
 
         /* Regardless, print the decode */
@@ -1377,7 +1411,6 @@ pandecode_vertex_tiler_prefix(struct mali_vertex_tiler_prefix *p, int job_no, bo
         if (p->unknown_draw)
                 pandecode_prop("unknown_draw = 0x%" PRIx32, p->unknown_draw);
 
-        pandecode_prop("workgroups_x_shift_2 = 0x%" PRIx32, p->workgroups_x_shift_2);
         pandecode_prop("workgroups_x_shift_3 = 0x%" PRIx32, p->workgroups_x_shift_3);
 
         if (p->draw_mode != MALI_DRAW_NONE)
@@ -2367,7 +2400,7 @@ pandecode_jc(mali_ptr jc_gpu_va, bool bifrost)
                 if (h->job_descriptor_size)
                         pandecode_prop("job_descriptor_size = %d", h->job_descriptor_size);
 
-                if (h->exception_status != 0x1)
+                if (h->exception_status && h->exception_status != 0x1)
                         pandecode_prop("exception_status = %x (source ID: 0x%x access: %s exception: 0x%x)",
                                        h->exception_status,
                                        (h->exception_status >> 16) & 0xFFFF,