1 // Copyright (c) 2015-2016 The Khronos Group Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/val/validate.h"
16
17 #include <functional>
18 #include <iterator>
19 #include <memory>
20 #include <string>
21 #include <vector>
22
23 #include "source/binary.h"
24 #include "source/diagnostic.h"
25 #include "source/enum_string_mapping.h"
26 #include "source/extensions.h"
27 #include "source/opcode.h"
28 #include "source/spirv_constant.h"
29 #include "source/spirv_endian.h"
30 #include "source/spirv_target_env.h"
31 #include "source/val/construct.h"
32 #include "source/val/instruction.h"
33 #include "source/val/validation_state.h"
34 #include "spirv-tools/libspirv.h"
35
36 namespace {
37 // TODO(issue 1950): The validator only returns a single message anyway, so no
38 // point in generating more than 1 warning.
39 static uint32_t kDefaultMaxNumOfWarnings = 1;
40 } // namespace
41
42 namespace spvtools {
43 namespace val {
44 namespace {
45
46 // Parses OpExtension instruction and registers extension.
RegisterExtension(ValidationState_t & _,const spv_parsed_instruction_t * inst)47 void RegisterExtension(ValidationState_t& _,
48 const spv_parsed_instruction_t* inst) {
49 const std::string extension_str = spvtools::GetExtensionString(inst);
50 Extension extension;
51 if (!GetExtensionFromString(extension_str.c_str(), &extension)) {
52 // The error will be logged in the ProcessInstruction pass.
53 return;
54 }
55
56 _.RegisterExtension(extension);
57 }
58
59 // Parses the beginning of the module searching for OpExtension instructions.
60 // Registers extensions if recognized. Returns SPV_REQUESTED_TERMINATION
61 // once an instruction which is not spv::Op::OpCapability and
62 // spv::Op::OpExtension is encountered. According to the SPIR-V spec extensions
63 // are declared after capabilities and before everything else.
ProcessExtensions(void * user_data,const spv_parsed_instruction_t * inst)64 spv_result_t ProcessExtensions(void* user_data,
65 const spv_parsed_instruction_t* inst) {
66 const spv::Op opcode = static_cast<spv::Op>(inst->opcode);
67 if (opcode == spv::Op::OpCapability) return SPV_SUCCESS;
68
69 if (opcode == spv::Op::OpExtension) {
70 ValidationState_t& _ = *(reinterpret_cast<ValidationState_t*>(user_data));
71 RegisterExtension(_, inst);
72 return SPV_SUCCESS;
73 }
74
75 // OpExtension block is finished, requesting termination.
76 return SPV_REQUESTED_TERMINATION;
77 }
78
ProcessInstruction(void * user_data,const spv_parsed_instruction_t * inst)79 spv_result_t ProcessInstruction(void* user_data,
80 const spv_parsed_instruction_t* inst) {
81 ValidationState_t& _ = *(reinterpret_cast<ValidationState_t*>(user_data));
82
83 auto* instruction = _.AddOrderedInstruction(inst);
84 _.RegisterDebugInstruction(instruction);
85
86 return SPV_SUCCESS;
87 }
88
ValidateForwardDecls(ValidationState_t & _)89 spv_result_t ValidateForwardDecls(ValidationState_t& _) {
90 if (_.unresolved_forward_id_count() == 0) return SPV_SUCCESS;
91
92 std::stringstream ss;
93 std::vector<uint32_t> ids = _.UnresolvedForwardIds();
94
95 std::transform(
96 std::begin(ids), std::end(ids),
97 std::ostream_iterator<std::string>(ss, " "),
98 bind(&ValidationState_t::getIdName, std::ref(_), std::placeholders::_1));
99
100 auto id_str = ss.str();
101 return _.diag(SPV_ERROR_INVALID_ID, nullptr)
102 << "The following forward referenced IDs have not been defined:\n"
103 << id_str.substr(0, id_str.size() - 1);
104 }
105
106 // Entry point validation. Based on 2.16.1 (Universal Validation Rules) of the
107 // SPIRV spec:
108 // * There is at least one OpEntryPoint instruction, unless the Linkage
109 // capability is being used.
110 // * No function can be targeted by both an OpEntryPoint instruction and an
111 // OpFunctionCall instruction.
112 //
113 // Additionally enforces that entry points for Vulkan should not have recursion.
ValidateEntryPoints(ValidationState_t & _)114 spv_result_t ValidateEntryPoints(ValidationState_t& _) {
115 _.ComputeFunctionToEntryPointMapping();
116 _.ComputeRecursiveEntryPoints();
117
118 if (_.entry_points().empty() && !_.HasCapability(spv::Capability::Linkage)) {
119 return _.diag(SPV_ERROR_INVALID_BINARY, nullptr)
120 << "No OpEntryPoint instruction was found. This is only allowed if "
121 "the Linkage capability is being used.";
122 }
123
124 for (const auto& entry_point : _.entry_points()) {
125 if (_.IsFunctionCallTarget(entry_point)) {
126 return _.diag(SPV_ERROR_INVALID_BINARY, _.FindDef(entry_point))
127 << "A function (" << entry_point
128 << ") may not be targeted by both an OpEntryPoint instruction and "
129 "an OpFunctionCall instruction.";
130 }
131
132 // For Vulkan, the static function-call graph for an entry point
133 // must not contain cycles.
134 if (spvIsVulkanEnv(_.context()->target_env)) {
135 if (_.recursive_entry_points().find(entry_point) !=
136 _.recursive_entry_points().end()) {
137 return _.diag(SPV_ERROR_INVALID_BINARY, _.FindDef(entry_point))
138 << _.VkErrorID(4634)
139 << "Entry points may not have a call graph with cycles.";
140 }
141 }
142 }
143
144 if (auto error = ValidateFloatControls2(_)) {
145 return error;
146 }
147 if (auto error = ValidateDuplicateExecutionModes(_)) {
148 return error;
149 }
150
151 return SPV_SUCCESS;
152 }
153
ValidateBinaryUsingContextAndValidationState(const spv_context_t & context,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic,ValidationState_t * vstate)154 spv_result_t ValidateBinaryUsingContextAndValidationState(
155 const spv_context_t& context, const uint32_t* words, const size_t num_words,
156 spv_diagnostic* pDiagnostic, ValidationState_t* vstate) {
157 auto binary = std::unique_ptr<spv_const_binary_t>(
158 new spv_const_binary_t{words, num_words});
159
160 spv_endianness_t endian;
161 spv_position_t position = {};
162 if (spvBinaryEndianness(binary.get(), &endian)) {
163 return DiagnosticStream(position, context.consumer, "",
164 SPV_ERROR_INVALID_BINARY)
165 << "Invalid SPIR-V magic number.";
166 }
167
168 spv_header_t header;
169 if (spvBinaryHeaderGet(binary.get(), endian, &header)) {
170 return DiagnosticStream(position, context.consumer, "",
171 SPV_ERROR_INVALID_BINARY)
172 << "Invalid SPIR-V header.";
173 }
174
175 if (header.version > spvVersionForTargetEnv(context.target_env)) {
176 return DiagnosticStream(position, context.consumer, "",
177 SPV_ERROR_WRONG_VERSION)
178 << "Invalid SPIR-V binary version "
179 << SPV_SPIRV_VERSION_MAJOR_PART(header.version) << "."
180 << SPV_SPIRV_VERSION_MINOR_PART(header.version)
181 << " for target environment "
182 << spvTargetEnvDescription(context.target_env) << ".";
183 }
184
185 if (header.bound > vstate->options()->universal_limits_.max_id_bound) {
186 return DiagnosticStream(position, context.consumer, "",
187 SPV_ERROR_INVALID_BINARY)
188 << "Invalid SPIR-V. The id bound is larger than the max id bound "
189 << vstate->options()->universal_limits_.max_id_bound << ".";
190 }
191
192 // Look for OpExtension instructions and register extensions.
193 // This parse should not produce any error messages. Hijack the context and
194 // replace the message consumer so that we do not pollute any state in input
195 // consumer.
196 spv_context_t hijacked_context = context;
197 hijacked_context.consumer = [](spv_message_level_t, const char*,
198 const spv_position_t&, const char*) {};
199 spvBinaryParse(&hijacked_context, vstate, words, num_words,
200 /* parsed_header = */ nullptr, ProcessExtensions,
201 /* diagnostic = */ nullptr);
202
203 // Parse the module and perform inline validation checks. These checks do
204 // not require the knowledge of the whole module.
205 if (auto error = spvBinaryParse(&context, vstate, words, num_words,
206 /*parsed_header =*/nullptr,
207 ProcessInstruction, pDiagnostic)) {
208 return error;
209 }
210
211 bool has_mask_task_nv = false;
212 bool has_mask_task_ext = false;
213 std::vector<Instruction*> visited_entry_points;
214 for (auto& instruction : vstate->ordered_instructions()) {
215 {
216 // In order to do this work outside of Process Instruction we need to be
217 // able to, briefly, de-const the instruction.
218 Instruction* inst = const_cast<Instruction*>(&instruction);
219
220 if (inst->opcode() == spv::Op::OpEntryPoint) {
221 const auto entry_point = inst->GetOperandAs<uint32_t>(1);
222 const auto execution_model = inst->GetOperandAs<spv::ExecutionModel>(0);
223 const std::string desc_name = inst->GetOperandAs<std::string>(2);
224
225 ValidationState_t::EntryPointDescription desc;
226 desc.name = desc_name;
227
228 std::vector<uint32_t> interfaces;
229 for (size_t j = 3; j < inst->operands().size(); ++j)
230 desc.interfaces.push_back(inst->word(inst->operand(j).offset));
231
232 vstate->RegisterEntryPoint(entry_point, execution_model,
233 std::move(desc));
234
235 if (visited_entry_points.size() > 0) {
236 for (const Instruction* check_inst : visited_entry_points) {
237 const auto check_execution_model =
238 check_inst->GetOperandAs<spv::ExecutionModel>(0);
239 const std::string check_name =
240 check_inst->GetOperandAs<std::string>(2);
241
242 if (desc_name == check_name &&
243 execution_model == check_execution_model) {
244 return vstate->diag(SPV_ERROR_INVALID_DATA, inst)
245 << "2 Entry points cannot share the same name and "
246 "ExecutionMode.";
247 }
248 }
249 }
250 visited_entry_points.push_back(inst);
251
252 has_mask_task_nv |= (execution_model == spv::ExecutionModel::TaskNV ||
253 execution_model == spv::ExecutionModel::MeshNV);
254 has_mask_task_ext |= (execution_model == spv::ExecutionModel::TaskEXT ||
255 execution_model == spv::ExecutionModel::MeshEXT);
256 }
257 if (inst->opcode() == spv::Op::OpFunctionCall) {
258 if (!vstate->in_function_body()) {
259 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, &instruction)
260 << "A FunctionCall must happen within a function body.";
261 }
262
263 const auto called_id = inst->GetOperandAs<uint32_t>(2);
264 vstate->AddFunctionCallTarget(called_id);
265 }
266
267 if (vstate->in_function_body()) {
268 inst->set_function(&(vstate->current_function()));
269 inst->set_block(vstate->current_function().current_block());
270
271 if (vstate->in_block() && spvOpcodeIsBlockTerminator(inst->opcode())) {
272 vstate->current_function().current_block()->set_terminator(inst);
273 }
274 }
275
276 if (auto error = IdPass(*vstate, inst)) return error;
277 }
278
279 if (auto error = CapabilityPass(*vstate, &instruction)) return error;
280 if (auto error = ModuleLayoutPass(*vstate, &instruction)) return error;
281 if (auto error = CfgPass(*vstate, &instruction)) return error;
282 if (auto error = InstructionPass(*vstate, &instruction)) return error;
283
284 // Now that all of the checks are done, update the state.
285 {
286 Instruction* inst = const_cast<Instruction*>(&instruction);
287 vstate->RegisterInstruction(inst);
288 if (inst->opcode() == spv::Op::OpTypeForwardPointer) {
289 vstate->RegisterForwardPointer(inst->GetOperandAs<uint32_t>(0));
290 }
291 }
292 }
293
294 if (!vstate->has_memory_model_specified())
295 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
296 << "Missing required OpMemoryModel instruction.";
297
298 if (vstate->in_function_body())
299 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
300 << "Missing OpFunctionEnd at end of module.";
301
302 if (vstate->HasCapability(spv::Capability::BindlessTextureNV) &&
303 !vstate->has_samplerimage_variable_address_mode_specified())
304 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
305 << "Missing required OpSamplerImageAddressingModeNV instruction.";
306
307 if (has_mask_task_ext && has_mask_task_nv)
308 return vstate->diag(SPV_ERROR_INVALID_LAYOUT, nullptr)
309 << vstate->VkErrorID(7102)
310 << "Module can't mix MeshEXT/TaskEXT with MeshNV/TaskNV Execution "
311 "Model.";
312
313 // Catch undefined forward references before performing further checks.
314 if (auto error = ValidateForwardDecls(*vstate)) return error;
315
316 // Calculate reachability after all the blocks are parsed, but early that it
317 // can be relied on in subsequent pases.
318 ReachabilityPass(*vstate);
319
320 // ID usage needs be handled in its own iteration of the instructions,
321 // between the two others. It depends on the first loop to have been
322 // finished, so that all instructions have been registered. And the following
323 // loop depends on all of the usage data being populated. Thus it cannot live
324 // in either of those iterations.
325 // It should also live after the forward declaration check, since it will
326 // have problems with missing forward declarations, but give less useful error
327 // messages.
328 for (size_t i = 0; i < vstate->ordered_instructions().size(); ++i) {
329 auto& instruction = vstate->ordered_instructions()[i];
330 if (auto error = UpdateIdUse(*vstate, &instruction)) return error;
331 }
332
333 // Validate individual opcodes.
334 for (size_t i = 0; i < vstate->ordered_instructions().size(); ++i) {
335 auto& instruction = vstate->ordered_instructions()[i];
336
337 // Keep these passes in the order they appear in the SPIR-V specification
338 // sections to maintain test consistency.
339 if (auto error = MiscPass(*vstate, &instruction)) return error;
340 if (auto error = DebugPass(*vstate, &instruction)) return error;
341 if (auto error = AnnotationPass(*vstate, &instruction)) return error;
342 if (auto error = ExtensionPass(*vstate, &instruction)) return error;
343 if (auto error = ModeSettingPass(*vstate, &instruction)) return error;
344 if (auto error = TypePass(*vstate, &instruction)) return error;
345 if (auto error = ConstantPass(*vstate, &instruction)) return error;
346 if (auto error = MemoryPass(*vstate, &instruction)) return error;
347 if (auto error = FunctionPass(*vstate, &instruction)) return error;
348 if (auto error = ImagePass(*vstate, &instruction)) return error;
349 if (auto error = ConversionPass(*vstate, &instruction)) return error;
350 if (auto error = CompositesPass(*vstate, &instruction)) return error;
351 if (auto error = ArithmeticsPass(*vstate, &instruction)) return error;
352 if (auto error = BitwisePass(*vstate, &instruction)) return error;
353 if (auto error = LogicalsPass(*vstate, &instruction)) return error;
354 if (auto error = ControlFlowPass(*vstate, &instruction)) return error;
355 if (auto error = DerivativesPass(*vstate, &instruction)) return error;
356 if (auto error = AtomicsPass(*vstate, &instruction)) return error;
357 if (auto error = PrimitivesPass(*vstate, &instruction)) return error;
358 if (auto error = BarriersPass(*vstate, &instruction)) return error;
359 // Group
360 // Device-Side Enqueue
361 // Pipe
362 if (auto error = NonUniformPass(*vstate, &instruction)) return error;
363
364 if (auto error = LiteralsPass(*vstate, &instruction)) return error;
365 if (auto error = RayQueryPass(*vstate, &instruction)) return error;
366 if (auto error = RayTracingPass(*vstate, &instruction)) return error;
367 if (auto error = RayReorderNVPass(*vstate, &instruction)) return error;
368 if (auto error = MeshShadingPass(*vstate, &instruction)) return error;
369 }
370
371 // Validate the preconditions involving adjacent instructions. e.g.
372 // spv::Op::OpPhi must only be preceded by spv::Op::OpLabel, spv::Op::OpPhi,
373 // or spv::Op::OpLine.
374 if (auto error = ValidateAdjacency(*vstate)) return error;
375
376 if (auto error = ValidateEntryPoints(*vstate)) return error;
377 // CFG checks are performed after the binary has been parsed
378 // and the CFGPass has collected information about the control flow
379 if (auto error = PerformCfgChecks(*vstate)) return error;
380 if (auto error = CheckIdDefinitionDominateUse(*vstate)) return error;
381 if (auto error = ValidateDecorations(*vstate)) return error;
382 if (auto error = ValidateInterfaces(*vstate)) return error;
383 // TODO(dsinclair): Restructure ValidateBuiltins so we can move into the
384 // for() above as it loops over all ordered_instructions internally.
385 if (auto error = ValidateBuiltIns(*vstate)) return error;
386 // These checks must be performed after individual opcode checks because
387 // those checks register the limitation checked here.
388 for (const auto& inst : vstate->ordered_instructions()) {
389 if (auto error = ValidateExecutionLimitations(*vstate, &inst)) return error;
390 if (auto error = ValidateSmallTypeUses(*vstate, &inst)) return error;
391 if (auto error = ValidateQCOMImageProcessingTextureUsages(*vstate, &inst))
392 return error;
393 }
394
395 return SPV_SUCCESS;
396 }
397
398 } // namespace
399
ValidateBinaryAndKeepValidationState(const spv_const_context context,spv_const_validator_options options,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic,std::unique_ptr<ValidationState_t> * vstate)400 spv_result_t ValidateBinaryAndKeepValidationState(
401 const spv_const_context context, spv_const_validator_options options,
402 const uint32_t* words, const size_t num_words, spv_diagnostic* pDiagnostic,
403 std::unique_ptr<ValidationState_t>* vstate) {
404 spv_context_t hijack_context = *context;
405 if (pDiagnostic) {
406 *pDiagnostic = nullptr;
407 UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
408 }
409
410 vstate->reset(new ValidationState_t(&hijack_context, options, words,
411 num_words, kDefaultMaxNumOfWarnings));
412
413 return ValidateBinaryUsingContextAndValidationState(
414 hijack_context, words, num_words, pDiagnostic, vstate->get());
415 }
416
417 } // namespace val
418 } // namespace spvtools
419
spvValidate(const spv_const_context context,const spv_const_binary binary,spv_diagnostic * pDiagnostic)420 spv_result_t spvValidate(const spv_const_context context,
421 const spv_const_binary binary,
422 spv_diagnostic* pDiagnostic) {
423 return spvValidateBinary(context, binary->code, binary->wordCount,
424 pDiagnostic);
425 }
426
spvValidateBinary(const spv_const_context context,const uint32_t * words,const size_t num_words,spv_diagnostic * pDiagnostic)427 spv_result_t spvValidateBinary(const spv_const_context context,
428 const uint32_t* words, const size_t num_words,
429 spv_diagnostic* pDiagnostic) {
430 spv_context_t hijack_context = *context;
431 if (pDiagnostic) {
432 *pDiagnostic = nullptr;
433 spvtools::UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
434 }
435
436 // This interface is used for default command line options.
437 spv_validator_options default_options = spvValidatorOptionsCreate();
438
439 // Create the ValidationState using the context and default options.
440 spvtools::val::ValidationState_t vstate(&hijack_context, default_options,
441 words, num_words,
442 kDefaultMaxNumOfWarnings);
443
444 spv_result_t result =
445 spvtools::val::ValidateBinaryUsingContextAndValidationState(
446 hijack_context, words, num_words, pDiagnostic, &vstate);
447
448 spvValidatorOptionsDestroy(default_options);
449 return result;
450 }
451
spvValidateWithOptions(const spv_const_context context,spv_const_validator_options options,const spv_const_binary binary,spv_diagnostic * pDiagnostic)452 spv_result_t spvValidateWithOptions(const spv_const_context context,
453 spv_const_validator_options options,
454 const spv_const_binary binary,
455 spv_diagnostic* pDiagnostic) {
456 spv_context_t hijack_context = *context;
457 if (pDiagnostic) {
458 *pDiagnostic = nullptr;
459 spvtools::UseDiagnosticAsMessageConsumer(&hijack_context, pDiagnostic);
460 }
461
462 // Create the ValidationState using the context.
463 spvtools::val::ValidationState_t vstate(&hijack_context, options,
464 binary->code, binary->wordCount,
465 kDefaultMaxNumOfWarnings);
466
467 return spvtools::val::ValidateBinaryUsingContextAndValidationState(
468 hijack_context, binary->code, binary->wordCount, pDiagnostic, &vstate);
469 }
470