1 // Copyright (c) 2015-2016 The Khronos Group Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/val/validate.h"
16
17 #include <functional>
18 #include <iterator>
19 #include <memory>
20 #include <string>
21 #include <vector>
22
23 #include "source/binary.h"
24 #include "source/diagnostic.h"
25 #include "source/enum_string_mapping.h"
26 #include "source/extensions.h"
27 #include "source/opcode.h"
28 #include "source/spirv_constant.h"
29 #include "source/spirv_endian.h"
30 #include "source/spirv_target_env.h"
31 #include "source/val/construct.h"
32 #include "source/val/instruction.h"
33 #include "source/val/validation_state.h"
34 #include "spirv-tools/libspirv.h"
35
36 namespace {
37 // TODO(issue 1950): The validator only returns a single message anyway, so no
38 // point in generating more than 1 warning.
39 static uint32_t kDefaultMaxNumOfWarnings = 1;
40 } // namespace
41
42 namespace spvtools {
43 namespace val {
44 namespace {
45
46 // Parses OpExtension instruction and registers extension.
RegisterExtension(ValidationState_t & _,const spv_parsed_instruction_t * inst)47 void RegisterExtension(ValidationState_t& _,
48 const spv_parsed_instruction_t* inst) {
49 const std::string extension_str = spvtools::GetExtensionString(inst);
50 Extension extension;
51 if (!GetExtensionFromString(extension_str.c_str(), &extension)) {
52 // The error will be logged in the ProcessInstruction pass.
53 return;
54 }
55
56 _.RegisterExtension(extension);
57 }
58
59 // Parses the beginning of the module searching for OpExtension instructions.
60 // Registers extensions if recognized. Returns SPV_REQUESTED_TERMINATION
61 // once an instruction which is not spv::Op::OpCapability and
62 // spv::Op::OpExtension is encountered. According to the SPIR-V spec extensions
63 // are declared after capabilities and before everything else.
ProcessExtensions(void * user_data,const spv_parsed_instruction_t * inst)64 spv_result_t ProcessExtensions(void* user_data,
65 const spv_parsed_instruction_t* inst) {
66 const spv::Op opcode = static_cast<spv::Op>(inst->opcode);
67 if (opcode == spv::Op::OpCapability) return SPV_SUCCESS;
68
69 if (opcode == spv::Op::OpExtension) {
70 ValidationState_t& _ = *(reinterpret_cast<ValidationState_t*>(user_data));
71 RegisterExtension(_, inst);
72 return SPV_SUCCESS;
73 }
74
75 // OpExtension block is finished, requesting termination.
76 return SPV_REQUESTED_TERMINATION;
77 }
78
ProcessInstruction(void * user_data,const spv_parsed_instruction_t * inst)79 spv_result_t ProcessInstruction(void* user_data,
80 const spv_parsed_instruction_t* inst) {
81 ValidationState_t& _ = *(reinterpret_cast<ValidationState_t*>(user_data));
82
83 auto* instruction = _.AddOrderedInstruction(inst);
84 _.RegisterDebugInstruction(instruction);
85
86 return SPV_SUCCESS;
87 }
88
ValidateForwardDecls(ValidationState_t & _)89 spv_result_t ValidateForwardDecls(ValidationState_t& _) {
90 if (_.unresolved_forward_id_count() == 0) return SPV_SUCCESS;
91
92 std::stringstream ss;
93 std::vector<uint32_t> ids = _.UnresolvedForwardIds();
94
95 std::transform(
96 std::begin(ids), std::end(ids),
97 std::ostream_iterator<std::string>(ss, " "),
98 bind(&ValidationState_t::getIdName, std::ref(_), std::placeholders::_1));
99
100 auto id_str = ss.str();
101 return _.diag(SPV_ERROR_INVALID_ID, nullptr)
102 << "The following forward referenced IDs have not been defined:\n"
103 << id_str.substr(0, id_str.size() - 1);
104 }
105
106 // Entry point validation. Based on 2.16.1 (Universal Validation Rules) of the
107 // SPIRV spec:
108 // * There is at least one OpEntryPoint instruction, unless the Linkage
109 // capability is being used.
110 // * No function can be targeted by both an OpEntryPoint instruction and an
111 // OpFunctionCall instruction.
112 //
113 // Additionally enforces that entry points for Vulkan should not have recursion.
ValidateEntryPoints(ValidationState_t & _)114 spv_result_t ValidateEntryPoints(ValidationState_t& _) {
115 _.ComputeFunctionToEntryPointMapping();
116 _.ComputeRecursiveEntryPoints();
117
118 if (_.entry_points().empty() && !_.HasCapability(spv::Capability::Linkage)) {
119 return _.diag(SPV_ERROR_INVALID_BINARY, nullptr)
120 << "No OpEntryPoint instruction was found. This is only allowed if "
121 "the Linkage capability is being used.";
122 }
123
124 for (const auto& entry_point : _.entry_points()) {
125 if (_.IsFunctionCallTarget(entry_point)) {
126 return _.diag(SPV_ERROR_INVALID_BINARY, _.FindDef(entry_point))
127 << "A function (" << entry_point
128 << ") may not be targeted by both an OpEntryPoint instruction and "
129 "an OpFunctionCall instruction.";
130 }
131
132 // For Vulkan, the static function-call graph for an entry point
133 // must not contain cycles.
134 if (spvIsVulkanEnv(_.context()->target_env)) {
135 if (_.recursive_entry_points().find(entry_point) !=
136 _.recursive_entry_points().end()) {
137 return _.diag(SPV_ERROR_INVALID_BINARY, _.FindDef(entry_point))
138 << _.VkErrorID(4634)
139 << "Entry points may not have a call graph with cycles.";
140 }
141 }
142 }
143
144 if (auto error = ValidateFloatControls2(_)) {
145 return error;
146 }
147
148 return SPV_SUCCESS;
149 }
150
ValidateBinaryUsingContextAndValidationState(const spv_context_t & context,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic,ValidationState_t * vstate)151 spv_result_t ValidateBinaryUsingContextAndValidationState(
152 const spv_context_t& context, const uint32_t* words, const size_t num_words,
153 spv_diagnostic* pDiagnostic, ValidationState_t* vstate) {
154 auto binary = std::unique_ptr<spv_const_binary_t>(
155 new spv_const_binary_t{words, num_words});
156
157 spv_endianness_t endian;
158 spv_position_t position = {};
159 if (spvBinaryEndianness(binary.get(), &endian)) {
160 return DiagnosticStream(position, context.consumer, "",
161 SPV_ERROR_INVALID_BINARY)
162 << "Invalid SPIR-V magic number.";
163 }
164
165 spv_header_t header;
166 if (spvBinaryHeaderGet(binary.get(), endian, &header)) {
167 return DiagnosticStream(position, context.consumer, "",
168 SPV_ERROR_INVALID_BINARY)
169 << "Invalid SPIR-V header.";
170 }
171
172 if (header.version > spvVersionForTargetEnv(context.target_env)) {
173 return DiagnosticStream(position, context.consumer, "",
174 SPV_ERROR_WRONG_VERSION)
175 << "Invalid SPIR-V binary version "
176 << SPV_SPIRV_VERSION_MAJOR_PART(header.version) << "."
177 << SPV_SPIRV_VERSION_MINOR_PART(header.version)
178 << " for target environment "
179 << spvTargetEnvDescription(context.target_env) << ".";
180 }
181
182 if (header.bound > vstate->options()->universal_limits_.max_id_bound) {
183 return DiagnosticStream(position, context.consumer, "",
184 SPV_ERROR_INVALID_BINARY)
185 << "Invalid SPIR-V. The id bound is larger than the max id bound "
186 << vstate->options()->universal_limits_.max_id_bound << ".";
187 }
188
189 // Look for OpExtension instructions and register extensions.
190 // This parse should not produce any error messages. Hijack the context and
191 // replace the message consumer so that we do not pollute any state in input
192 // consumer.
193 spv_context_t hijacked_context = context;
194 hijacked_context.consumer = [](spv_message_level_t, const char*,
195 const spv_position_t&, const char*) {};
196 spvBinaryParse(&hijacked_context, vstate, words, num_words,
197 /* parsed_header = */ nullptr, ProcessExtensions,
198 /* diagnostic = */ nullptr);
199
200 // Parse the module and perform inline validation checks. These checks do
201 // not require the knowledge of the whole module.
202 if (auto error = spvBinaryParse(&context, vstate, words, num_words,
203 /*parsed_header =*/nullptr,
204 ProcessInstruction, pDiagnostic)) {
205 return error;
206 }
207
208 bool has_mask_task_nv = false;
209 bool has_mask_task_ext = false;
210 std::vector<Instruction*> visited_entry_points;
211 for (auto& instruction : vstate->ordered_instructions()) {
212 {
213 // In order to do this work outside of Process Instruction we need to be
214 // able to, briefly, de-const the instruction.
215 Instruction* inst = const_cast<Instruction*>(&instruction);
216
217 if (inst->opcode() == spv::Op::OpEntryPoint) {
218 const auto entry_point = inst->GetOperandAs<uint32_t>(1);
219 const auto execution_model = inst->GetOperandAs<spv::ExecutionModel>(0);
220 const std::string desc_name = inst->GetOperandAs<std::string>(2);
221
222 ValidationState_t::EntryPointDescription desc;
223 desc.name = desc_name;
224
225 std::vector<uint32_t> interfaces;
226 for (size_t j = 3; j < inst->operands().size(); ++j)
227 desc.interfaces.push_back(inst->word(inst->operand(j).offset));
228
229 vstate->RegisterEntryPoint(entry_point, execution_model,
230 std::move(desc));
231
232 if (visited_entry_points.size() > 0) {
233 for (const Instruction* check_inst : visited_entry_points) {
234 const auto check_execution_model =
235 check_inst->GetOperandAs<spv::ExecutionModel>(0);
236 const std::string check_name =
237 check_inst->GetOperandAs<std::string>(2);
238
239 if (desc_name == check_name &&
240 execution_model == check_execution_model) {
241 return vstate->diag(SPV_ERROR_INVALID_DATA, inst)
242 << "2 Entry points cannot share the same name and "
243 "ExecutionMode.";
244 }
245 }
246 }
247 visited_entry_points.push_back(inst);
248
249 has_mask_task_nv |= (execution_model == spv::ExecutionModel::TaskNV ||
250 execution_model == spv::ExecutionModel::MeshNV);
251 has_mask_task_ext |= (execution_model == spv::ExecutionModel::TaskEXT ||
252 execution_model == spv::ExecutionModel::MeshEXT);
253 }
254 if (inst->opcode() == spv::Op::OpFunctionCall) {
255 if (!vstate->in_function_body()) {
256 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, &instruction)
257 << "A FunctionCall must happen within a function body.";
258 }
259
260 const auto called_id = inst->GetOperandAs<uint32_t>(2);
261 vstate->AddFunctionCallTarget(called_id);
262 }
263
264 if (vstate->in_function_body()) {
265 inst->set_function(&(vstate->current_function()));
266 inst->set_block(vstate->current_function().current_block());
267
268 if (vstate->in_block() && spvOpcodeIsBlockTerminator(inst->opcode())) {
269 vstate->current_function().current_block()->set_terminator(inst);
270 }
271 }
272
273 if (auto error = IdPass(*vstate, inst)) return error;
274 }
275
276 if (auto error = CapabilityPass(*vstate, &instruction)) return error;
277 if (auto error = ModuleLayoutPass(*vstate, &instruction)) return error;
278 if (auto error = CfgPass(*vstate, &instruction)) return error;
279 if (auto error = InstructionPass(*vstate, &instruction)) return error;
280
281 // Now that all of the checks are done, update the state.
282 {
283 Instruction* inst = const_cast<Instruction*>(&instruction);
284 vstate->RegisterInstruction(inst);
285 if (inst->opcode() == spv::Op::OpTypeForwardPointer) {
286 vstate->RegisterForwardPointer(inst->GetOperandAs<uint32_t>(0));
287 }
288 }
289 }
290
291 if (!vstate->has_memory_model_specified())
292 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
293 << "Missing required OpMemoryModel instruction.";
294
295 if (vstate->in_function_body())
296 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
297 << "Missing OpFunctionEnd at end of module.";
298
299 if (vstate->HasCapability(spv::Capability::BindlessTextureNV) &&
300 !vstate->has_samplerimage_variable_address_mode_specified())
301 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
302 << "Missing required OpSamplerImageAddressingModeNV instruction.";
303
304 if (has_mask_task_ext && has_mask_task_nv)
305 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
306 << vstate->VkErrorID(7102)
307 << "Module can't mix MeshEXT/TaskEXT with MeshNV/TaskNV Execution "
308 "Model.";
309
310 // Catch undefined forward references before performing further checks.
311 if (auto error = ValidateForwardDecls(*vstate)) return error;
312
313 // Calculate reachability after all the blocks are parsed, but early that it
314 // can be relied on in subsequent pases.
315 ReachabilityPass(*vstate);
316
317 // ID usage needs be handled in its own iteration of the instructions,
318 // between the two others. It depends on the first loop to have been
319 // finished, so that all instructions have been registered. And the following
320 // loop depends on all of the usage data being populated. Thus it cannot live
321 // in either of those iterations.
322 // It should also live after the forward declaration check, since it will
323 // have problems with missing forward declarations, but give less useful error
324 // messages.
325 for (size_t i = 0; i < vstate->ordered_instructions().size(); ++i) {
326 auto& instruction = vstate->ordered_instructions()[i];
327 if (auto error = UpdateIdUse(*vstate, &instruction)) return error;
328 }
329
330 // Validate individual opcodes.
331 for (size_t i = 0; i < vstate->ordered_instructions().size(); ++i) {
332 auto& instruction = vstate->ordered_instructions()[i];
333
334 // Keep these passes in the order they appear in the SPIR-V specification
335 // sections to maintain test consistency.
336 if (auto error = MiscPass(*vstate, &instruction)) return error;
337 if (auto error = DebugPass(*vstate, &instruction)) return error;
338 if (auto error = AnnotationPass(*vstate, &instruction)) return error;
339 if (auto error = ExtensionPass(*vstate, &instruction)) return error;
340 if (auto error = ModeSettingPass(*vstate, &instruction)) return error;
341 if (auto error = TypePass(*vstate, &instruction)) return error;
342 if (auto error = ConstantPass(*vstate, &instruction)) return error;
343 if (auto error = MemoryPass(*vstate, &instruction)) return error;
344 if (auto error = FunctionPass(*vstate, &instruction)) return error;
345 if (auto error = ImagePass(*vstate, &instruction)) return error;
346 if (auto error = ConversionPass(*vstate, &instruction)) return error;
347 if (auto error = CompositesPass(*vstate, &instruction)) return error;
348 if (auto error = ArithmeticsPass(*vstate, &instruction)) return error;
349 if (auto error = BitwisePass(*vstate, &instruction)) return error;
350 if (auto error = LogicalsPass(*vstate, &instruction)) return error;
351 if (auto error = ControlFlowPass(*vstate, &instruction)) return error;
352 if (auto error = DerivativesPass(*vstate, &instruction)) return error;
353 if (auto error = AtomicsPass(*vstate, &instruction)) return error;
354 if (auto error = PrimitivesPass(*vstate, &instruction)) return error;
355 if (auto error = BarriersPass(*vstate, &instruction)) return error;
356 // Group
357 // Device-Side Enqueue
358 // Pipe
359 if (auto error = NonUniformPass(*vstate, &instruction)) return error;
360
361 if (auto error = LiteralsPass(*vstate, &instruction)) return error;
362 if (auto error = RayQueryPass(*vstate, &instruction)) return error;
363 if (auto error = RayTracingPass(*vstate, &instruction)) return error;
364 if (auto error = RayReorderNVPass(*vstate, &instruction)) return error;
365 if (auto error = MeshShadingPass(*vstate, &instruction)) return error;
366 }
367
368 // Validate the preconditions involving adjacent instructions. e.g.
369 // spv::Op::OpPhi must only be preceded by spv::Op::OpLabel, spv::Op::OpPhi,
370 // or spv::Op::OpLine.
371 if (auto error = ValidateAdjacency(*vstate)) return error;
372
373 if (auto error = ValidateEntryPoints(*vstate)) return error;
374 // CFG checks are performed after the binary has been parsed
375 // and the CFGPass has collected information about the control flow
376 if (auto error = PerformCfgChecks(*vstate)) return error;
377 if (auto error = CheckIdDefinitionDominateUse(*vstate)) return error;
378 if (auto error = ValidateDecorations(*vstate)) return error;
379 if (auto error = ValidateInterfaces(*vstate)) return error;
380 // TODO(dsinclair): Restructure ValidateBuiltins so we can move into the
381 // for() above as it loops over all ordered_instructions internally.
382 if (auto error = ValidateBuiltIns(*vstate)) return error;
383 // These checks must be performed after individual opcode checks because
384 // those checks register the limitation checked here.
385 for (const auto& inst : vstate->ordered_instructions()) {
386 if (auto error = ValidateExecutionLimitations(*vstate, &inst)) return error;
387 if (auto error = ValidateSmallTypeUses(*vstate, &inst)) return error;
388 if (auto error = ValidateQCOMImageProcessingTextureUsages(*vstate, &inst))
389 return error;
390 }
391
392 return SPV_SUCCESS;
393 }
394
395 } // namespace
396
ValidateBinaryAndKeepValidationState(const spv_const_context context,spv_const_validator_options options,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic,std::unique_ptr<ValidationState_t> * vstate)397 spv_result_t ValidateBinaryAndKeepValidationState(
398 const spv_const_context context, spv_const_validator_options options,
399 const uint32_t* words, const size_t num_words, spv_diagnostic* pDiagnostic,
400 std::unique_ptr<ValidationState_t>* vstate) {
401 spv_context_t hijack_context = *context;
402 if (pDiagnostic) {
403 *pDiagnostic = nullptr;
404 UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
405 }
406
407 vstate->reset(new ValidationState_t(&hijack_context, options, words,
408 num_words, kDefaultMaxNumOfWarnings));
409
410 return ValidateBinaryUsingContextAndValidationState(
411 hijack_context, words, num_words, pDiagnostic, vstate->get());
412 }
413
414 } // namespace val
415 } // namespace spvtools
416
spvValidate(const spv_const_context context,const spv_const_binary binary,spv_diagnostic * pDiagnostic)417 spv_result_t spvValidate(const spv_const_context context,
418 const spv_const_binary binary,
419 spv_diagnostic* pDiagnostic) {
420 return spvValidateBinary(context, binary->code, binary->wordCount,
421 pDiagnostic);
422 }
423
spvValidateBinary(const spv_const_context context,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic)424 spv_result_t spvValidateBinary(const spv_const_context context,
425 const uint32_t* words, const size_t num_words,
426 spv_diagnostic* pDiagnostic) {
427 spv_context_t hijack_context = *context;
428 if (pDiagnostic) {
429 *pDiagnostic = nullptr;
430 spvtools::UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
431 }
432
433 // This interface is used for default command line options.
434 spv_validator_options default_options = spvValidatorOptionsCreate();
435
436 // Create the ValidationState using the context and default options.
437 spvtools::val::ValidationState_t vstate(&hijack_context, default_options,
438 words, num_words,
439 kDefaultMaxNumOfWarnings);
440
441 spv_result_t result =
442 spvtools::val::ValidateBinaryUsingContextAndValidationState(
443 hijack_context, words, num_words, pDiagnostic, &vstate);
444
445 spvValidatorOptionsDestroy(default_options);
446 return result;
447 }
448
spvValidateWithOptions(const spv_const_context context,spv_const_validator_options options,const spv_const_binary binary,spv_diagnostic * pDiagnostic)449 spv_result_t spvValidateWithOptions(const spv_const_context context,
450 spv_const_validator_options options,
451 const spv_const_binary binary,
452 spv_diagnostic* pDiagnostic) {
453 spv_context_t hijack_context = *context;
454 if (pDiagnostic) {
455 *pDiagnostic = nullptr;
456 spvtools::UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
457 }
458
459 // Create the ValidationState using the context.
460 spvtools::val::ValidationState_t vstate(&hijack_context, options,
461 binary->code, binary->wordCount,
462 kDefaultMaxNumOfWarnings);
463
464 return spvtools::val::ValidateBinaryUsingContextAndValidationState(
465 hijack_context, binary->code, binary->wordCount, pDiagnostic, &vstate);
466 }
467