1 // Copyright (c) 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // This pass injects code in a graphics shader to implement guarantees
16 // satisfying Vulkan's robustBufferAcces rules. Robust access rules permit
17 // an out-of-bounds access to be redirected to an access of the same type
18 // (load, store, etc.) but within the same root object.
19 //
20 // We assume baseline functionality in Vulkan, i.e. the module uses
21 // logical addressing mode, without VK_KHR_variable_pointers.
22 //
23 // - Logical addressing mode implies:
24 // - Each root pointer (a pointer that exists other than by the
25 // execution of a shader instruction) is the result of an OpVariable.
26 //
27 // - Instructions that result in pointers are:
28 // OpVariable
29 // OpAccessChain
30 // OpInBoundsAccessChain
31 // OpFunctionParameter
32 // OpImageTexelPointer
33 // OpCopyObject
34 //
35 // - Instructions that use a pointer are:
36 // OpLoad
37 // OpStore
38 // OpAccessChain
39 // OpInBoundsAccessChain
40 // OpFunctionCall
41 // OpImageTexelPointer
42 // OpCopyMemory
43 // OpCopyObject
44 // all OpAtomic* instructions
45 //
46 // We classify pointer-users into:
47 // - Accesses:
48 // - OpLoad
49 // - OpStore
50 // - OpAtomic*
51 // - OpCopyMemory
52 //
53 // - Address calculations:
54 // - OpAccessChain
55 // - OpInBoundsAccessChain
56 //
57 // - Pass-through:
58 // - OpFunctionCall
59 // - OpFunctionParameter
60 // - OpCopyObject
61 //
62 // The strategy is:
63 //
64 // - Handle only logical addressing mode. In particular, don't handle a module
65 // if it uses one of the variable-pointers capabilities.
66 //
67 // - Don't handle modules using capability RuntimeDescriptorArrayEXT. So the
68 // only runtime arrays are those that are the last member in a
69 // Block-decorated struct. This allows us to feasibly/easily compute the
70 // length of the runtime array. See below.
71 //
72 // - The memory locations accessed by OpLoad, OpStore, OpCopyMemory, and
73 // OpAtomic* are determined by their pointer parameter or parameters.
74 // Pointers are always (correctly) typed and so the address and number of
75 // consecutive locations are fully determined by the pointer.
76 //
77 // - A pointer value orginates as one of few cases:
78 //
79 // - OpVariable for an interface object or an array of them: image,
80 // buffer (UBO or SSBO), sampler, sampled-image, push-constant, input
81 // variable, output variable. The execution environment is responsible for
82 // allocating the correct amount of storage for these, and for ensuring
83 // each resource bound to such a variable is big enough to contain the
84 // SPIR-V pointee type of the variable.
85 //
86 // - OpVariable for a non-interface object. These are variables in
87 // Workgroup, Private, and Function storage classes. The compiler ensures
88 // the underlying allocation is big enough to store the entire SPIR-V
89 // pointee type of the variable.
90 //
91 // - An OpFunctionParameter. This always maps to a pointer parameter to an
92 // OpFunctionCall.
93 //
94 // - In logical addressing mode, these are severely limited:
95 // "Any pointer operand to an OpFunctionCall must be:
96 // - a memory object declaration, or
97 // - a pointer to an element in an array that is a memory object
98 // declaration, where the element type is OpTypeSampler or OpTypeImage"
99 //
100 // - This has an important simplifying consequence:
101 //
102 // - When looking for a pointer to the structure containing a runtime
103 // array, you begin with a pointer to the runtime array and trace
104 // backward in the function. You never have to trace back beyond
105 // your function call boundary. So you can't take a partial access
106 // chain into an SSBO, then pass that pointer into a function. So
107 // we don't resort to using fat pointers to compute array length.
108 // We can trace back to a pointer to the containing structure,
109 // and use that in an OpArrayLength instruction. (The structure type
110 // gives us the member index of the runtime array.)
111 //
112 // - Otherwise, the pointer type fully encodes the range of valid
113 // addresses. In particular, the type of a pointer to an aggregate
114 // value fully encodes the range of indices when indexing into
115 // that aggregate.
116 //
117 // - The pointer is the result of an access chain instruction. We clamp
118 // indices contributing to address calculations. As noted above, the
119 // valid ranges are either bound by the length of a runtime array, or
120 // by the type of the base pointer. The length of a runtime array is
121 // the result of an OpArrayLength instruction acting on the pointer of
122 // the containing structure as noted above.
123 //
124 // - Access chain indices are always treated as signed, so:
125 // - Clamp the upper bound at the signed integer maximum.
126 // - Use SClamp for all clamping.
127 //
128 // - TODO(dneto): OpImageTexelPointer:
129 // - Clamp coordinate to the image size returned by OpImageQuerySize
130 // - If multi-sampled, clamp the sample index to the count returned by
131 // OpImageQuerySamples.
132 // - If not multi-sampled, set the sample index to 0.
133 //
134 // - Rely on the external validator to check that pointers are only
135 // used by the instructions as above.
136 //
137 // - Handles OpTypeRuntimeArray
138 // Track pointer back to original resource (pointer to struct), so we can
139 // query the runtime array size.
140 //
141
142 #include "graphics_robust_access_pass.h"
143
144 #include <algorithm>
145 #include <cstring>
146 #include <functional>
147 #include <initializer_list>
148 #include <limits>
149 #include <utility>
150
151 #include "constants.h"
152 #include "def_use_manager.h"
153 #include "function.h"
154 #include "ir_context.h"
155 #include "module.h"
156 #include "pass.h"
157 #include "source/diagnostic.h"
158 #include "source/util/make_unique.h"
159 #include "spirv-tools/libspirv.h"
160 #include "spirv/unified1/GLSL.std.450.h"
161 #include "spirv/unified1/spirv.h"
162 #include "type_manager.h"
163 #include "types.h"
164
165 namespace spvtools {
166 namespace opt {
167
168 using opt::Instruction;
169 using opt::Operand;
170 using spvtools::MakeUnique;
171
GraphicsRobustAccessPass()172 GraphicsRobustAccessPass::GraphicsRobustAccessPass() : module_status_() {}
173
Process()174 Pass::Status GraphicsRobustAccessPass::Process() {
175 module_status_ = PerModuleState();
176
177 ProcessCurrentModule();
178
179 auto result = module_status_.failed
180 ? Status::Failure
181 : (module_status_.modified ? Status::SuccessWithChange
182 : Status::SuccessWithoutChange);
183
184 return result;
185 }
186
Fail()187 spvtools::DiagnosticStream GraphicsRobustAccessPass::Fail() {
188 module_status_.failed = true;
189 // We don't really have a position, and we'll ignore the result.
190 return std::move(
191 spvtools::DiagnosticStream({}, consumer(), "", SPV_ERROR_INVALID_BINARY)
192 << name() << ": ");
193 }
194
IsCompatibleModule()195 spv_result_t GraphicsRobustAccessPass::IsCompatibleModule() {
196 auto* feature_mgr = context()->get_feature_mgr();
197 if (!feature_mgr->HasCapability(SpvCapabilityShader))
198 return Fail() << "Can only process Shader modules";
199 if (feature_mgr->HasCapability(SpvCapabilityVariablePointers))
200 return Fail() << "Can't process modules with VariablePointers capability";
201 if (feature_mgr->HasCapability(SpvCapabilityVariablePointersStorageBuffer))
202 return Fail() << "Can't process modules with VariablePointersStorageBuffer "
203 "capability";
204 if (feature_mgr->HasCapability(SpvCapabilityRuntimeDescriptorArrayEXT)) {
205 // These have a RuntimeArray outside of Block-decorated struct. There
206 // is no way to compute the array length from within SPIR-V.
207 return Fail() << "Can't process modules with RuntimeDescriptorArrayEXT "
208 "capability";
209 }
210
211 {
212 auto* inst = context()->module()->GetMemoryModel();
213 const auto addressing_model = inst->GetSingleWordOperand(0);
214 if (addressing_model != SpvAddressingModelLogical)
215 return Fail() << "Addressing model must be Logical. Found "
216 << inst->PrettyPrint();
217 }
218 return SPV_SUCCESS;
219 }
220
ProcessCurrentModule()221 spv_result_t GraphicsRobustAccessPass::ProcessCurrentModule() {
222 auto err = IsCompatibleModule();
223 if (err != SPV_SUCCESS) return err;
224
225 ProcessFunction fn = [this](opt::Function* f) { return ProcessAFunction(f); };
226 module_status_.modified |= context()->ProcessReachableCallTree(fn);
227
228 // Need something here. It's the price we pay for easier failure paths.
229 return SPV_SUCCESS;
230 }
231
ProcessAFunction(opt::Function * function)232 bool GraphicsRobustAccessPass::ProcessAFunction(opt::Function* function) {
233 // Ensure that all pointers computed inside a function are within bounds.
234 // Find the access chains in this block before trying to modify them.
235 std::vector<Instruction*> access_chains;
236 std::vector<Instruction*> image_texel_pointers;
237 for (auto& block : *function) {
238 for (auto& inst : block) {
239 switch (inst.opcode()) {
240 case SpvOpAccessChain:
241 case SpvOpInBoundsAccessChain:
242 access_chains.push_back(&inst);
243 break;
244 case SpvOpImageTexelPointer:
245 image_texel_pointers.push_back(&inst);
246 break;
247 default:
248 break;
249 }
250 }
251 }
252 for (auto* inst : access_chains) {
253 ClampIndicesForAccessChain(inst);
254 if (module_status_.failed) return module_status_.modified;
255 }
256
257 for (auto* inst : image_texel_pointers) {
258 if (SPV_SUCCESS != ClampCoordinateForImageTexelPointer(inst)) break;
259 }
260 return module_status_.modified;
261 }
262
ClampIndicesForAccessChain(Instruction * access_chain)263 void GraphicsRobustAccessPass::ClampIndicesForAccessChain(
264 Instruction* access_chain) {
265 Instruction& inst = *access_chain;
266
267 auto* constant_mgr = context()->get_constant_mgr();
268 auto* def_use_mgr = context()->get_def_use_mgr();
269 auto* type_mgr = context()->get_type_mgr();
270 const bool have_int64_cap =
271 context()->get_feature_mgr()->HasCapability(SpvCapabilityInt64);
272
273 // Replaces one of the OpAccessChain index operands with a new value.
274 // Updates def-use analysis.
275 auto replace_index = [&inst, def_use_mgr](uint32_t operand_index,
276 Instruction* new_value) {
277 inst.SetOperand(operand_index, {new_value->result_id()});
278 def_use_mgr->AnalyzeInstUse(&inst);
279 return SPV_SUCCESS;
280 };
281
282 // Replaces one of the OpAccesssChain index operands with a clamped value.
283 // Replace the operand at |operand_index| with the value computed from
284 // signed_clamp(%old_value, %min_value, %max_value). It also analyzes
285 // the new instruction and records that them module is modified.
286 // Assumes %min_value is signed-less-or-equal than %max_value. (All callees
287 // use 0 for %min_value).
288 auto clamp_index = [&inst, type_mgr, this, &replace_index](
289 uint32_t operand_index, Instruction* old_value,
290 Instruction* min_value, Instruction* max_value) {
291 auto* clamp_inst =
292 MakeSClampInst(*type_mgr, old_value, min_value, max_value, &inst);
293 return replace_index(operand_index, clamp_inst);
294 };
295
296 // Ensures the specified index of access chain |inst| has a value that is
297 // at most |count| - 1. If the index is already a constant value less than
298 // |count| then no change is made.
299 auto clamp_to_literal_count =
300 [&inst, this, &constant_mgr, &type_mgr, have_int64_cap, &replace_index,
301 &clamp_index](uint32_t operand_index, uint64_t count) -> spv_result_t {
302 Instruction* index_inst =
303 this->GetDef(inst.GetSingleWordOperand(operand_index));
304 const auto* index_type =
305 type_mgr->GetType(index_inst->type_id())->AsInteger();
306 assert(index_type);
307 const auto index_width = index_type->width();
308
309 if (count <= 1) {
310 // Replace the index with 0.
311 return replace_index(operand_index, GetValueForType(0, index_type));
312 }
313
314 uint64_t maxval = count - 1;
315
316 // Compute the bit width of a viable type to hold |maxval|.
317 // Look for a bit width, up to 64 bits wide, to fit maxval.
318 uint32_t maxval_width = index_width;
319 while ((maxval_width < 64) && (0 != (maxval >> maxval_width))) {
320 maxval_width *= 2;
321 }
322 // Determine the type for |maxval|.
323 uint32_t next_id = context()->module()->IdBound();
324 analysis::Integer signed_type_for_query(maxval_width, true);
325 auto* maxval_type =
326 type_mgr->GetRegisteredType(&signed_type_for_query)->AsInteger();
327 if (next_id != context()->module()->IdBound()) {
328 module_status_.modified = true;
329 }
330 // Access chain indices are treated as signed, so limit the maximum value
331 // of the index so it will always be positive for a signed clamp operation.
332 maxval = std::min(maxval, ((uint64_t(1) << (maxval_width - 1)) - 1));
333
334 if (index_width > 64) {
335 return this->Fail() << "Can't handle indices wider than 64 bits, found "
336 "constant index with "
337 << index_width << " bits as index number "
338 << operand_index << " of access chain "
339 << inst.PrettyPrint();
340 }
341
342 // Split into two cases: the current index is a constant, or not.
343
344 // If the index is a constant then |index_constant| will not be a null
345 // pointer. (If index is an |OpConstantNull| then it |index_constant| will
346 // not be a null pointer.) Since access chain indices must be scalar
347 // integers, this can't be a spec constant.
348 if (auto* index_constant = constant_mgr->GetConstantFromInst(index_inst)) {
349 auto* int_index_constant = index_constant->AsIntConstant();
350 int64_t value = 0;
351 // OpAccessChain indices are treated as signed. So get the signed
352 // constant value here.
353 if (index_width <= 32) {
354 value = int64_t(int_index_constant->GetS32BitValue());
355 } else if (index_width <= 64) {
356 value = int_index_constant->GetS64BitValue();
357 }
358 if (value < 0) {
359 return replace_index(operand_index, GetValueForType(0, index_type));
360 } else if (uint64_t(value) <= maxval) {
361 // Nothing to do.
362 return SPV_SUCCESS;
363 } else {
364 // Replace with maxval.
365 assert(count > 0); // Already took care of this case above.
366 return replace_index(operand_index,
367 GetValueForType(maxval, maxval_type));
368 }
369 } else {
370 // Generate a clamp instruction.
371 assert(maxval >= 1);
372 assert(index_width <= 64); // Otherwise, already returned above.
373 if (index_width >= 64 && !have_int64_cap) {
374 // An inconsistent module.
375 return Fail() << "Access chain index is wider than 64 bits, but Int64 "
376 "is not declared: "
377 << index_inst->PrettyPrint();
378 }
379 // Widen the index value if necessary
380 if (maxval_width > index_width) {
381 // Find the wider type. We only need this case if a constant array
382 // bound is too big.
383
384 // From how we calculated maxval_width, widening won't require adding
385 // the Int64 capability.
386 assert(have_int64_cap || maxval_width <= 32);
387 if (!have_int64_cap && maxval_width >= 64) {
388 // Be defensive, but this shouldn't happen.
389 return this->Fail()
390 << "Clamping index would require adding Int64 capability. "
391 << "Can't clamp 32-bit index " << operand_index
392 << " of access chain " << inst.PrettyPrint();
393 }
394 index_inst = WidenInteger(index_type->IsSigned(), maxval_width,
395 index_inst, &inst);
396 }
397
398 // Finally, clamp the index.
399 return clamp_index(operand_index, index_inst,
400 GetValueForType(0, maxval_type),
401 GetValueForType(maxval, maxval_type));
402 }
403 return SPV_SUCCESS;
404 };
405
406 // Ensures the specified index of access chain |inst| has a value that is at
407 // most the value of |count_inst| minus 1, where |count_inst| is treated as an
408 // unsigned integer. This can log a failure.
409 auto clamp_to_count = [&inst, this, &constant_mgr, &clamp_to_literal_count,
410 &clamp_index,
411 &type_mgr](uint32_t operand_index,
412 Instruction* count_inst) -> spv_result_t {
413 Instruction* index_inst =
414 this->GetDef(inst.GetSingleWordOperand(operand_index));
415 const auto* index_type =
416 type_mgr->GetType(index_inst->type_id())->AsInteger();
417 const auto* count_type =
418 type_mgr->GetType(count_inst->type_id())->AsInteger();
419 assert(index_type);
420 if (const auto* count_constant =
421 constant_mgr->GetConstantFromInst(count_inst)) {
422 uint64_t value = 0;
423 const auto width = count_constant->type()->AsInteger()->width();
424 if (width <= 32) {
425 value = count_constant->AsIntConstant()->GetU32BitValue();
426 } else if (width <= 64) {
427 value = count_constant->AsIntConstant()->GetU64BitValue();
428 } else {
429 return this->Fail() << "Can't handle indices wider than 64 bits, found "
430 "constant index with "
431 << index_type->width() << "bits";
432 }
433 return clamp_to_literal_count(operand_index, value);
434 } else {
435 // Widen them to the same width.
436 const auto index_width = index_type->width();
437 const auto count_width = count_type->width();
438 const auto target_width = std::max(index_width, count_width);
439 // UConvert requires the result type to have 0 signedness. So enforce
440 // that here.
441 auto* wider_type = index_width < count_width ? count_type : index_type;
442 if (index_type->width() < target_width) {
443 // Access chain indices are treated as signed integers.
444 index_inst = WidenInteger(true, target_width, index_inst, &inst);
445 } else if (count_type->width() < target_width) {
446 // Assume type sizes are treated as unsigned.
447 count_inst = WidenInteger(false, target_width, count_inst, &inst);
448 }
449 // Compute count - 1.
450 // It doesn't matter if 1 is signed or unsigned.
451 auto* one = GetValueForType(1, wider_type);
452 auto* count_minus_1 = InsertInst(
453 &inst, SpvOpISub, type_mgr->GetId(wider_type), TakeNextId(),
454 {{SPV_OPERAND_TYPE_ID, {count_inst->result_id()}},
455 {SPV_OPERAND_TYPE_ID, {one->result_id()}}});
456 auto* zero = GetValueForType(0, wider_type);
457 // Make sure we clamp to an upper bound that is at most the signed max
458 // for the target type.
459 const uint64_t max_signed_value =
460 ((uint64_t(1) << (target_width - 1)) - 1);
461 // Use unsigned-min to ensure that the result is always non-negative.
462 // That ensures we satisfy the invariant for SClamp, where the "min"
463 // argument we give it (zero), is no larger than the third argument.
464 auto* upper_bound =
465 MakeUMinInst(*type_mgr, count_minus_1,
466 GetValueForType(max_signed_value, wider_type), &inst);
467 // Now clamp the index to this upper bound.
468 return clamp_index(operand_index, index_inst, zero, upper_bound);
469 }
470 return SPV_SUCCESS;
471 };
472
473 const Instruction* base_inst = GetDef(inst.GetSingleWordInOperand(0));
474 const Instruction* base_type = GetDef(base_inst->type_id());
475 Instruction* pointee_type = GetDef(base_type->GetSingleWordInOperand(1));
476
477 // Walk the indices from earliest to latest, replacing indices with a
478 // clamped value, and updating the pointee_type. The order matters for
479 // the case when we have to compute the length of a runtime array. In
480 // that the algorithm relies on the fact that that the earlier indices
481 // have already been clamped.
482 const uint32_t num_operands = inst.NumOperands();
483 for (uint32_t idx = 3; !module_status_.failed && idx < num_operands; ++idx) {
484 const uint32_t index_id = inst.GetSingleWordOperand(idx);
485 Instruction* index_inst = GetDef(index_id);
486
487 switch (pointee_type->opcode()) {
488 case SpvOpTypeMatrix: // Use column count
489 case SpvOpTypeVector: // Use component count
490 {
491 const uint32_t count = pointee_type->GetSingleWordOperand(2);
492 clamp_to_literal_count(idx, count);
493 pointee_type = GetDef(pointee_type->GetSingleWordOperand(1));
494 } break;
495
496 case SpvOpTypeArray: {
497 // The array length can be a spec constant, so go through the general
498 // case.
499 Instruction* array_len = GetDef(pointee_type->GetSingleWordOperand(2));
500 clamp_to_count(idx, array_len);
501 pointee_type = GetDef(pointee_type->GetSingleWordOperand(1));
502 } break;
503
504 case SpvOpTypeStruct: {
505 // SPIR-V requires the index to be an OpConstant.
506 // We need to know the index literal value so we can compute the next
507 // pointee type.
508 if (index_inst->opcode() != SpvOpConstant ||
509 !constant_mgr->GetConstantFromInst(index_inst)
510 ->type()
511 ->AsInteger()) {
512 Fail() << "Member index into struct is not a constant integer: "
513 << index_inst->PrettyPrint(
514 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES)
515 << "\nin access chain: "
516 << inst.PrettyPrint(SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
517 return;
518 }
519 const auto num_members = pointee_type->NumInOperands();
520 const auto* index_constant =
521 constant_mgr->GetConstantFromInst(index_inst);
522 // Get the sign-extended value, since access index is always treated as
523 // signed.
524 const auto index_value = index_constant->GetSignExtendedValue();
525 if (index_value < 0 || index_value >= num_members) {
526 Fail() << "Member index " << index_value
527 << " is out of bounds for struct type: "
528 << pointee_type->PrettyPrint(
529 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES)
530 << "\nin access chain: "
531 << inst.PrettyPrint(SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
532 return;
533 }
534 pointee_type = GetDef(pointee_type->GetSingleWordInOperand(
535 static_cast<uint32_t>(index_value)));
536 // No need to clamp this index. We just checked that it's valid.
537 } break;
538
539 case SpvOpTypeRuntimeArray: {
540 auto* array_len = MakeRuntimeArrayLengthInst(&inst, idx);
541 if (!array_len) { // We've already signaled an error.
542 return;
543 }
544 clamp_to_count(idx, array_len);
545 if (module_status_.failed) return;
546 pointee_type = GetDef(pointee_type->GetSingleWordOperand(1));
547 } break;
548
549 default:
550 Fail() << " Unhandled pointee type for access chain "
551 << pointee_type->PrettyPrint(
552 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
553 }
554 }
555 }
556
GetGlslInsts()557 uint32_t GraphicsRobustAccessPass::GetGlslInsts() {
558 if (module_status_.glsl_insts_id == 0) {
559 // This string serves double-duty as raw data for a string and for a vector
560 // of 32-bit words
561 const char glsl[] = "GLSL.std.450\0\0\0\0";
562 const size_t glsl_str_byte_len = 16;
563 // Use an existing import if we can.
564 for (auto& inst : context()->module()->ext_inst_imports()) {
565 const auto& name_words = inst.GetInOperand(0).words;
566 if (0 == std::strncmp(reinterpret_cast<const char*>(name_words.data()),
567 glsl, glsl_str_byte_len)) {
568 module_status_.glsl_insts_id = inst.result_id();
569 }
570 }
571 if (module_status_.glsl_insts_id == 0) {
572 // Make a new import instruction.
573 module_status_.glsl_insts_id = TakeNextId();
574 std::vector<uint32_t> words(glsl_str_byte_len / sizeof(uint32_t));
575 std::memcpy(words.data(), glsl, glsl_str_byte_len);
576 auto import_inst = MakeUnique<Instruction>(
577 context(), SpvOpExtInstImport, 0, module_status_.glsl_insts_id,
578 std::initializer_list<Operand>{
579 Operand{SPV_OPERAND_TYPE_LITERAL_STRING, std::move(words)}});
580 Instruction* inst = import_inst.get();
581 context()->module()->AddExtInstImport(std::move(import_inst));
582 module_status_.modified = true;
583 context()->AnalyzeDefUse(inst);
584 // Reanalyze the feature list, since we added an extended instruction
585 // set improt.
586 context()->get_feature_mgr()->Analyze(context()->module());
587 }
588 }
589 return module_status_.glsl_insts_id;
590 }
591
GetValueForType(uint64_t value,const analysis::Integer * type)592 opt::Instruction* opt::GraphicsRobustAccessPass::GetValueForType(
593 uint64_t value, const analysis::Integer* type) {
594 auto* mgr = context()->get_constant_mgr();
595 assert(type->width() <= 64);
596 std::vector<uint32_t> words;
597 words.push_back(uint32_t(value));
598 if (type->width() > 32) {
599 words.push_back(uint32_t(value >> 32u));
600 }
601 const auto* constant = mgr->GetConstant(type, words);
602 return mgr->GetDefiningInstruction(
603 constant, context()->get_type_mgr()->GetTypeInstruction(type));
604 }
605
WidenInteger(bool sign_extend,uint32_t bit_width,Instruction * value,Instruction * before_inst)606 opt::Instruction* opt::GraphicsRobustAccessPass::WidenInteger(
607 bool sign_extend, uint32_t bit_width, Instruction* value,
608 Instruction* before_inst) {
609 analysis::Integer unsigned_type_for_query(bit_width, false);
610 auto* type_mgr = context()->get_type_mgr();
611 auto* unsigned_type = type_mgr->GetRegisteredType(&unsigned_type_for_query);
612 auto type_id = context()->get_type_mgr()->GetId(unsigned_type);
613 auto conversion_id = TakeNextId();
614 auto* conversion = InsertInst(
615 before_inst, (sign_extend ? SpvOpSConvert : SpvOpUConvert), type_id,
616 conversion_id, {{SPV_OPERAND_TYPE_ID, {value->result_id()}}});
617 return conversion;
618 }
619
MakeUMinInst(const analysis::TypeManager & tm,Instruction * x,Instruction * y,Instruction * where)620 Instruction* GraphicsRobustAccessPass::MakeUMinInst(
621 const analysis::TypeManager& tm, Instruction* x, Instruction* y,
622 Instruction* where) {
623 // Get IDs of instructions we'll be referencing. Evaluate them before calling
624 // the function so we force a deterministic ordering in case both of them need
625 // to take a new ID.
626 const uint32_t glsl_insts_id = GetGlslInsts();
627 uint32_t smin_id = TakeNextId();
628 const auto xwidth = tm.GetType(x->type_id())->AsInteger()->width();
629 const auto ywidth = tm.GetType(y->type_id())->AsInteger()->width();
630 assert(xwidth == ywidth);
631 (void)xwidth;
632 (void)ywidth;
633 auto* smin_inst = InsertInst(
634 where, SpvOpExtInst, x->type_id(), smin_id,
635 {
636 {SPV_OPERAND_TYPE_ID, {glsl_insts_id}},
637 {SPV_OPERAND_TYPE_EXTENSION_INSTRUCTION_NUMBER, {GLSLstd450UMin}},
638 {SPV_OPERAND_TYPE_ID, {x->result_id()}},
639 {SPV_OPERAND_TYPE_ID, {y->result_id()}},
640 });
641 return smin_inst;
642 }
643
MakeSClampInst(const analysis::TypeManager & tm,Instruction * x,Instruction * min,Instruction * max,Instruction * where)644 Instruction* GraphicsRobustAccessPass::MakeSClampInst(
645 const analysis::TypeManager& tm, Instruction* x, Instruction* min,
646 Instruction* max, Instruction* where) {
647 // Get IDs of instructions we'll be referencing. Evaluate them before calling
648 // the function so we force a deterministic ordering in case both of them need
649 // to take a new ID.
650 const uint32_t glsl_insts_id = GetGlslInsts();
651 uint32_t clamp_id = TakeNextId();
652 const auto xwidth = tm.GetType(x->type_id())->AsInteger()->width();
653 const auto minwidth = tm.GetType(min->type_id())->AsInteger()->width();
654 const auto maxwidth = tm.GetType(max->type_id())->AsInteger()->width();
655 assert(xwidth == minwidth);
656 assert(xwidth == maxwidth);
657 (void)xwidth;
658 (void)minwidth;
659 (void)maxwidth;
660 auto* clamp_inst = InsertInst(
661 where, SpvOpExtInst, x->type_id(), clamp_id,
662 {
663 {SPV_OPERAND_TYPE_ID, {glsl_insts_id}},
664 {SPV_OPERAND_TYPE_EXTENSION_INSTRUCTION_NUMBER, {GLSLstd450SClamp}},
665 {SPV_OPERAND_TYPE_ID, {x->result_id()}},
666 {SPV_OPERAND_TYPE_ID, {min->result_id()}},
667 {SPV_OPERAND_TYPE_ID, {max->result_id()}},
668 });
669 return clamp_inst;
670 }
671
MakeRuntimeArrayLengthInst(Instruction * access_chain,uint32_t operand_index)672 Instruction* GraphicsRobustAccessPass::MakeRuntimeArrayLengthInst(
673 Instruction* access_chain, uint32_t operand_index) {
674 // The Index parameter to the access chain at |operand_index| is indexing
675 // *into* the runtime-array. To get the number of elements in the runtime
676 // array we need a pointer to the Block-decorated struct that contains the
677 // runtime array. So conceptually we have to go 2 steps backward in the
678 // access chain. The two steps backward might forces us to traverse backward
679 // across multiple dominating instructions.
680 auto* type_mgr = context()->get_type_mgr();
681
682 // How many access chain indices do we have to unwind to find the pointer
683 // to the struct containing the runtime array?
684 uint32_t steps_remaining = 2;
685 // Find or create an instruction computing the pointer to the structure
686 // containing the runtime array.
687 // Walk backward through pointer address calculations until we either get
688 // to exactly the right base pointer, or to an access chain instruction
689 // that we can replicate but truncate to compute the address of the right
690 // struct.
691 Instruction* current_access_chain = access_chain;
692 Instruction* pointer_to_containing_struct = nullptr;
693 while (steps_remaining > 0) {
694 switch (current_access_chain->opcode()) {
695 case SpvOpCopyObject:
696 // Whoops. Walk right through this one.
697 current_access_chain =
698 GetDef(current_access_chain->GetSingleWordInOperand(0));
699 break;
700 case SpvOpAccessChain:
701 case SpvOpInBoundsAccessChain: {
702 const int first_index_operand = 3;
703 // How many indices in this access chain contribute to getting us
704 // to an element in the runtime array?
705 const auto num_contributing_indices =
706 current_access_chain == access_chain
707 ? operand_index - (first_index_operand - 1)
708 : current_access_chain->NumInOperands() - 1 /* skip the base */;
709 Instruction* base =
710 GetDef(current_access_chain->GetSingleWordInOperand(0));
711 if (num_contributing_indices == steps_remaining) {
712 // The base pointer points to the structure.
713 pointer_to_containing_struct = base;
714 steps_remaining = 0;
715 break;
716 } else if (num_contributing_indices < steps_remaining) {
717 // Peel off the index and keep going backward.
718 steps_remaining -= num_contributing_indices;
719 current_access_chain = base;
720 } else {
721 // This access chain has more indices than needed. Generate a new
722 // access chain instruction, but truncating the list of indices.
723 const int base_operand = 2;
724 // We'll use the base pointer and the indices up to but not including
725 // the one indexing into the runtime array.
726 Instruction::OperandList ops;
727 // Use the base pointer
728 ops.push_back(current_access_chain->GetOperand(base_operand));
729 const uint32_t num_indices_to_keep =
730 num_contributing_indices - steps_remaining - 1;
731 for (uint32_t i = 0; i <= num_indices_to_keep; i++) {
732 ops.push_back(
733 current_access_chain->GetOperand(first_index_operand + i));
734 }
735 // Compute the type of the result of the new access chain. Start at
736 // the base and walk the indices in a forward direction.
737 auto* constant_mgr = context()->get_constant_mgr();
738 std::vector<uint32_t> indices_for_type;
739 for (uint32_t i = 0; i < ops.size() - 1; i++) {
740 uint32_t index_for_type_calculation = 0;
741 Instruction* index =
742 GetDef(current_access_chain->GetSingleWordOperand(
743 first_index_operand + i));
744 if (auto* index_constant =
745 constant_mgr->GetConstantFromInst(index)) {
746 // We only need 32 bits. For the type calculation, it's sufficient
747 // to take the zero-extended value. It only matters for the struct
748 // case, and struct member indices are unsigned.
749 index_for_type_calculation =
750 uint32_t(index_constant->GetZeroExtendedValue());
751 } else {
752 // Indexing into a variably-sized thing like an array. Use 0.
753 index_for_type_calculation = 0;
754 }
755 indices_for_type.push_back(index_for_type_calculation);
756 }
757 auto* base_ptr_type = type_mgr->GetType(base->type_id())->AsPointer();
758 auto* base_pointee_type = base_ptr_type->pointee_type();
759 auto* new_access_chain_result_pointee_type =
760 type_mgr->GetMemberType(base_pointee_type, indices_for_type);
761 const uint32_t new_access_chain_type_id = type_mgr->FindPointerToType(
762 type_mgr->GetId(new_access_chain_result_pointee_type),
763 base_ptr_type->storage_class());
764
765 // Create the instruction and insert it.
766 const auto new_access_chain_id = TakeNextId();
767 auto* new_access_chain =
768 InsertInst(current_access_chain, current_access_chain->opcode(),
769 new_access_chain_type_id, new_access_chain_id, ops);
770 pointer_to_containing_struct = new_access_chain;
771 steps_remaining = 0;
772 break;
773 }
774 } break;
775 default:
776 Fail() << "Unhandled access chain in logical addressing mode passes "
777 "through "
778 << current_access_chain->PrettyPrint(
779 SPV_BINARY_TO_TEXT_OPTION_SHOW_BYTE_OFFSET |
780 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
781 return nullptr;
782 }
783 }
784 assert(pointer_to_containing_struct);
785 auto* pointee_type =
786 type_mgr->GetType(pointer_to_containing_struct->type_id())
787 ->AsPointer()
788 ->pointee_type();
789
790 auto* struct_type = pointee_type->AsStruct();
791 const uint32_t member_index_of_runtime_array =
792 uint32_t(struct_type->element_types().size() - 1);
793 // Create the length-of-array instruction before the original access chain,
794 // but after the generation of the pointer to the struct.
795 const auto array_len_id = TakeNextId();
796 analysis::Integer uint_type_for_query(32, false);
797 auto* uint_type = type_mgr->GetRegisteredType(&uint_type_for_query);
798 auto* array_len = InsertInst(
799 access_chain, SpvOpArrayLength, type_mgr->GetId(uint_type), array_len_id,
800 {{SPV_OPERAND_TYPE_ID, {pointer_to_containing_struct->result_id()}},
801 {SPV_OPERAND_TYPE_LITERAL_INTEGER, {member_index_of_runtime_array}}});
802 return array_len;
803 }
804
ClampCoordinateForImageTexelPointer(opt::Instruction * image_texel_pointer)805 spv_result_t GraphicsRobustAccessPass::ClampCoordinateForImageTexelPointer(
806 opt::Instruction* image_texel_pointer) {
807 // TODO(dneto): Write tests for this code.
808 // TODO(dneto): Use signed-clamp
809 (void)(image_texel_pointer);
810 return SPV_SUCCESS;
811
812 // Do not compile this code until it is ready to be used.
813 #if 0
814 // Example:
815 // %texel_ptr = OpImageTexelPointer %texel_ptr_type %image_ptr %coord
816 // %sample
817 //
818 // We want to clamp %coord components between vector-0 and the result
819 // of OpImageQuerySize acting on the underlying image. So insert:
820 // %image = OpLoad %image_type %image_ptr
821 // %query_size = OpImageQuerySize %query_size_type %image
822 //
823 // For a multi-sampled image, %sample is the sample index, and we need
824 // to clamp it between zero and the number of samples in the image.
825 // %sample_count = OpImageQuerySamples %uint %image
826 // %max_sample_index = OpISub %uint %sample_count %uint_1
827 // For non-multi-sampled images, the sample index must be constant zero.
828
829 auto* def_use_mgr = context()->get_def_use_mgr();
830 auto* type_mgr = context()->get_type_mgr();
831 auto* constant_mgr = context()->get_constant_mgr();
832
833 auto* image_ptr = GetDef(image_texel_pointer->GetSingleWordInOperand(0));
834 auto* image_ptr_type = GetDef(image_ptr->type_id());
835 auto image_type_id = image_ptr_type->GetSingleWordInOperand(1);
836 auto* image_type = GetDef(image_type_id);
837 auto* coord = GetDef(image_texel_pointer->GetSingleWordInOperand(1));
838 auto* samples = GetDef(image_texel_pointer->GetSingleWordInOperand(2));
839
840 // We will modify the module, at least by adding image query instructions.
841 module_status_.modified = true;
842
843 // Declare the ImageQuery capability if the module doesn't already have it.
844 auto* feature_mgr = context()->get_feature_mgr();
845 if (!feature_mgr->HasCapability(SpvCapabilityImageQuery)) {
846 auto cap = MakeUnique<Instruction>(
847 context(), SpvOpCapability, 0, 0,
848 std::initializer_list<Operand>{
849 {SPV_OPERAND_TYPE_CAPABILITY, {SpvCapabilityImageQuery}}});
850 def_use_mgr->AnalyzeInstDefUse(cap.get());
851 context()->AddCapability(std::move(cap));
852 feature_mgr->Analyze(context()->module());
853 }
854
855 // OpImageTexelPointer is used to translate a coordinate and sample index
856 // into an address for use with an atomic operation. That is, it may only
857 // used with what Vulkan calls a "storage image"
858 // (OpTypeImage parameter Sampled=2).
859 // Note: A storage image never has a level-of-detail associated with it.
860
861 // Constraints on the sample id:
862 // - Only 2D images can be multi-sampled: OpTypeImage parameter MS=1
863 // only if Dim=2D.
864 // - Non-multi-sampled images (OpTypeImage parameter MS=0) must use
865 // sample ID to a constant 0.
866
867 // The coordinate is treated as unsigned, and should be clamped against the
868 // image "size", returned by OpImageQuerySize. (Note: OpImageQuerySizeLod
869 // is only usable with a sampled image, i.e. its image type has Sampled=1).
870
871 // Determine the result type for the OpImageQuerySize.
872 // For non-arrayed images:
873 // non-Cube:
874 // - Always the same as the coordinate type
875 // Cube:
876 // - Use all but the last component of the coordinate (which is the face
877 // index from 0 to 5).
878 // For arrayed images (in Vulkan the Dim is 1D, 2D, or Cube):
879 // non-Cube:
880 // - A vector with the components in the coordinate, and one more for
881 // the layer index.
882 // Cube:
883 // - The same as the coordinate type: 3-element integer vector.
884 // - The third component from the size query is the layer count.
885 // - The third component in the texel pointer calculation is
886 // 6 * layer + face, where 0 <= face < 6.
887 // Cube: Use all but the last component of the coordinate (which is the face
888 // index from 0 to 5).
889 const auto dim = SpvDim(image_type->GetSingleWordInOperand(1));
890 const bool arrayed = image_type->GetSingleWordInOperand(3) == 1;
891 const bool multisampled = image_type->GetSingleWordInOperand(4) != 0;
892 const auto query_num_components = [dim, arrayed, this]() -> int {
893 const int arrayness_bonus = arrayed ? 1 : 0;
894 int num_coords = 0;
895 switch (dim) {
896 case SpvDimBuffer:
897 case SpvDim1D:
898 num_coords = 1;
899 break;
900 case SpvDimCube:
901 // For cube, we need bounds for x, y, but not face.
902 case SpvDimRect:
903 case SpvDim2D:
904 num_coords = 2;
905 break;
906 case SpvDim3D:
907 num_coords = 3;
908 break;
909 case SpvDimSubpassData:
910 case SpvDimMax:
911 return Fail() << "Invalid image dimension for OpImageTexelPointer: "
912 << int(dim);
913 break;
914 }
915 return num_coords + arrayness_bonus;
916 }();
917 const auto* coord_component_type = [type_mgr, coord]() {
918 const analysis::Type* coord_type = type_mgr->GetType(coord->type_id());
919 if (auto* vector_type = coord_type->AsVector()) {
920 return vector_type->element_type()->AsInteger();
921 }
922 return coord_type->AsInteger();
923 }();
924 // For now, only handle 32-bit case for coordinates.
925 if (!coord_component_type) {
926 return Fail() << " Coordinates for OpImageTexelPointer are not integral: "
927 << image_texel_pointer->PrettyPrint(
928 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
929 }
930 if (coord_component_type->width() != 32) {
931 return Fail() << " Expected OpImageTexelPointer coordinate components to "
932 "be 32-bits wide. They are "
933 << coord_component_type->width() << " bits. "
934 << image_texel_pointer->PrettyPrint(
935 SPV_BINARY_TO_TEXT_OPTION_FRIENDLY_NAMES);
936 }
937 const auto* query_size_type =
938 [type_mgr, coord_component_type,
939 query_num_components]() -> const analysis::Type* {
940 if (query_num_components == 1) return coord_component_type;
941 analysis::Vector proposed(coord_component_type, query_num_components);
942 return type_mgr->GetRegisteredType(&proposed);
943 }();
944
945 const uint32_t image_id = TakeNextId();
946 auto* image =
947 InsertInst(image_texel_pointer, SpvOpLoad, image_type_id, image_id,
948 {{SPV_OPERAND_TYPE_ID, {image_ptr->result_id()}}});
949
950 const uint32_t query_size_id = TakeNextId();
951 auto* query_size =
952 InsertInst(image_texel_pointer, SpvOpImageQuerySize,
953 type_mgr->GetTypeInstruction(query_size_type), query_size_id,
954 {{SPV_OPERAND_TYPE_ID, {image->result_id()}}});
955
956 auto* component_1 = constant_mgr->GetConstant(coord_component_type, {1});
957 const uint32_t component_1_id =
958 constant_mgr->GetDefiningInstruction(component_1)->result_id();
959 auto* component_0 = constant_mgr->GetConstant(coord_component_type, {0});
960 const uint32_t component_0_id =
961 constant_mgr->GetDefiningInstruction(component_0)->result_id();
962
963 // If the image is a cube array, then the last component of the queried
964 // size is the layer count. In the query, we have to accomodate folding
965 // in the face index ranging from 0 through 5. The inclusive upper bound
966 // on the third coordinate therefore is multiplied by 6.
967 auto* query_size_including_faces = query_size;
968 if (arrayed && (dim == SpvDimCube)) {
969 // Multiply the last coordinate by 6.
970 auto* component_6 = constant_mgr->GetConstant(coord_component_type, {6});
971 const uint32_t component_6_id =
972 constant_mgr->GetDefiningInstruction(component_6)->result_id();
973 assert(query_num_components == 3);
974 auto* multiplicand = constant_mgr->GetConstant(
975 query_size_type, {component_1_id, component_1_id, component_6_id});
976 auto* multiplicand_inst =
977 constant_mgr->GetDefiningInstruction(multiplicand);
978 const auto query_size_including_faces_id = TakeNextId();
979 query_size_including_faces = InsertInst(
980 image_texel_pointer, SpvOpIMul,
981 type_mgr->GetTypeInstruction(query_size_type),
982 query_size_including_faces_id,
983 {{SPV_OPERAND_TYPE_ID, {query_size_including_faces->result_id()}},
984 {SPV_OPERAND_TYPE_ID, {multiplicand_inst->result_id()}}});
985 }
986
987 // Make a coordinate-type with all 1 components.
988 auto* coordinate_1 =
989 query_num_components == 1
990 ? component_1
991 : constant_mgr->GetConstant(
992 query_size_type,
993 std::vector<uint32_t>(query_num_components, component_1_id));
994 // Make a coordinate-type with all 1 components.
995 auto* coordinate_0 =
996 query_num_components == 0
997 ? component_0
998 : constant_mgr->GetConstant(
999 query_size_type,
1000 std::vector<uint32_t>(query_num_components, component_0_id));
1001
1002 const uint32_t query_max_including_faces_id = TakeNextId();
1003 auto* query_max_including_faces = InsertInst(
1004 image_texel_pointer, SpvOpISub,
1005 type_mgr->GetTypeInstruction(query_size_type),
1006 query_max_including_faces_id,
1007 {{SPV_OPERAND_TYPE_ID, {query_size_including_faces->result_id()}},
1008 {SPV_OPERAND_TYPE_ID,
1009 {constant_mgr->GetDefiningInstruction(coordinate_1)->result_id()}}});
1010
1011 // Clamp the coordinate
1012 auto* clamp_coord = MakeSClampInst(
1013 *type_mgr, coord, constant_mgr->GetDefiningInstruction(coordinate_0),
1014 query_max_including_faces, image_texel_pointer);
1015 image_texel_pointer->SetInOperand(1, {clamp_coord->result_id()});
1016
1017 // Clamp the sample index
1018 if (multisampled) {
1019 // Get the sample count via OpImageQuerySamples
1020 const auto query_samples_id = TakeNextId();
1021 auto* query_samples = InsertInst(
1022 image_texel_pointer, SpvOpImageQuerySamples,
1023 constant_mgr->GetDefiningInstruction(component_0)->type_id(),
1024 query_samples_id, {{SPV_OPERAND_TYPE_ID, {image->result_id()}}});
1025
1026 const auto max_samples_id = TakeNextId();
1027 auto* max_samples = InsertInst(image_texel_pointer, SpvOpImageQuerySamples,
1028 query_samples->type_id(), max_samples_id,
1029 {{SPV_OPERAND_TYPE_ID, {query_samples_id}},
1030 {SPV_OPERAND_TYPE_ID, {component_1_id}}});
1031
1032 auto* clamp_samples = MakeSClampInst(
1033 *type_mgr, samples, constant_mgr->GetDefiningInstruction(coordinate_0),
1034 max_samples, image_texel_pointer);
1035 image_texel_pointer->SetInOperand(2, {clamp_samples->result_id()});
1036
1037 } else {
1038 // Just replace it with 0. Don't even check what was there before.
1039 image_texel_pointer->SetInOperand(2, {component_0_id});
1040 }
1041
1042 def_use_mgr->AnalyzeInstUse(image_texel_pointer);
1043
1044 return SPV_SUCCESS;
1045 #endif
1046 }
1047
InsertInst(opt::Instruction * where_inst,SpvOp opcode,uint32_t type_id,uint32_t result_id,const Instruction::OperandList & operands)1048 opt::Instruction* GraphicsRobustAccessPass::InsertInst(
1049 opt::Instruction* where_inst, SpvOp opcode, uint32_t type_id,
1050 uint32_t result_id, const Instruction::OperandList& operands) {
1051 module_status_.modified = true;
1052 auto* result = where_inst->InsertBefore(
1053 MakeUnique<Instruction>(context(), opcode, type_id, result_id, operands));
1054 context()->get_def_use_mgr()->AnalyzeInstDefUse(result);
1055 auto* basic_block = context()->get_instr_block(where_inst);
1056 context()->set_instr_block(result, basic_block);
1057 return result;
1058 }
1059
1060 } // namespace opt
1061 } // namespace spvtools
1062