Coverage Report

Created: 2026-08-14 06:34

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/spirv-tools/source/val/validate_function.cpp
Line
Count
Source
1
// Copyright (c) 2018 Google LLC.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//     http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14
15
#include <algorithm>
16
17
#include "source/opcode.h"
18
#include "source/table2.h"
19
#include "source/val/instruction.h"
20
#include "source/val/validate.h"
21
#include "source/val/validation_state.h"
22
23
namespace spvtools {
24
namespace val {
25
namespace {
26
27
// Returns true if |a| and |b| are instructions defining pointers that point to
28
// types logically match and the decorations that apply to |b| are a subset
29
// of the decorations that apply to |a|.
30
bool DoPointeesLogicallyMatch(val::Instruction* a, val::Instruction* b,
31
0
                              ValidationState_t& _) {
32
0
  if (a->opcode() != spv::Op::OpTypePointer ||
33
0
      b->opcode() != spv::Op::OpTypePointer) {
34
0
    return false;
35
0
  }
36
37
0
  const auto& dec_a = _.id_decorations(a->id());
38
0
  const auto& dec_b = _.id_decorations(b->id());
39
0
  for (const auto& dec : dec_b) {
40
0
    if (std::find(dec_a.begin(), dec_a.end(), dec) == dec_a.end()) {
41
0
      return false;
42
0
    }
43
0
  }
44
45
0
  uint32_t a_type = a->GetOperandAs<uint32_t>(2);
46
0
  uint32_t b_type = b->GetOperandAs<uint32_t>(2);
47
48
0
  if (a_type == b_type) {
49
0
    return true;
50
0
  }
51
52
0
  Instruction* a_type_inst = _.FindDef(a_type);
53
0
  Instruction* b_type_inst = _.FindDef(b_type);
54
55
0
  return _.LogicallyMatch(a_type_inst, b_type_inst, true);
56
0
}
57
58
43.4k
spv_result_t ValidateFunction(ValidationState_t& _, const Instruction* inst) {
59
43.4k
  const auto function_type_id = inst->GetOperandAs<uint32_t>(3);
60
43.4k
  const auto function_type = _.FindDef(function_type_id);
61
43.4k
  if (!function_type || spv::Op::OpTypeFunction != function_type->opcode()) {
62
72
    return _.diag(SPV_ERROR_INVALID_ID, inst)
63
72
           << "OpFunction Function Type <id> " << _.getIdName(function_type_id)
64
72
           << " is not a function type.";
65
72
  }
66
67
43.3k
  const auto return_id = function_type->GetOperandAs<uint32_t>(1);
68
43.3k
  if (return_id != inst->type_id()) {
69
16
    return _.diag(SPV_ERROR_INVALID_ID, inst)
70
16
           << "OpFunction Result Type <id> " << _.getIdName(inst->type_id())
71
16
           << " does not match the Function Type's return type <id> "
72
16
           << _.getIdName(return_id) << ".";
73
16
  }
74
75
43.3k
  const std::vector<spv::Op> acceptable = {
76
43.3k
      spv::Op::OpGroupDecorate,
77
43.3k
      spv::Op::OpDecorate,
78
43.3k
      spv::Op::OpEnqueueKernel,
79
43.3k
      spv::Op::OpEntryPoint,
80
43.3k
      spv::Op::OpExecutionMode,
81
43.3k
      spv::Op::OpExecutionModeId,
82
43.3k
      spv::Op::OpFunctionCall,
83
43.3k
      spv::Op::OpGetKernelNDrangeSubGroupCount,
84
43.3k
      spv::Op::OpGetKernelNDrangeMaxSubGroupSize,
85
43.3k
      spv::Op::OpGetKernelWorkGroupSize,
86
43.3k
      spv::Op::OpGetKernelPreferredWorkGroupSizeMultiple,
87
43.3k
      spv::Op::OpGetKernelLocalSizeForSubgroupCount,
88
43.3k
      spv::Op::OpGetKernelMaxNumSubgroups,
89
43.3k
      spv::Op::OpName,
90
43.3k
      spv::Op::OpCooperativeMatrixPerElementOpEXT,
91
43.3k
      spv::Op::OpCooperativeMatrixReduceEXT,
92
43.3k
      spv::Op::OpCooperativeMatrixLoadTensorNV,
93
43.3k
      spv::Op::OpConditionalEntryPointINTEL,
94
43.3k
      spv::Op::OpConstantFunctionPointerINTEL};
95
100k
  for (auto& pair : inst->uses()) {
96
100k
    const auto* use = pair.first;
97
100k
    if (std::find(acceptable.begin(), acceptable.end(), use->opcode()) ==
98
100k
            acceptable.end() &&
99
17
        !use->IsNonSemantic() && !use->IsDebugInfo() &&
100
17
        !spvOpcodeIsDecoration(use->opcode())) {
101
17
      return _.diag(SPV_ERROR_INVALID_ID, use)
102
17
             << "Invalid use of function result id " << _.getIdName(inst->id())
103
17
             << ".";
104
17
    }
105
100k
  }
106
107
43.3k
  return SPV_SUCCESS;
108
43.3k
}
109
110
spv_result_t ValidateFunctionParameter(ValidationState_t& _,
111
19.5k
                                       const Instruction* inst) {
112
  // NOTE: Find OpFunction & ensure OpFunctionParameter is not out of place.
113
19.5k
  size_t param_index = 0;
114
19.5k
  size_t inst_num = inst->LineNum() - 1;
115
19.5k
  auto func_inst = &_.ordered_instructions()[inst_num];
116
34.2k
  while (--inst_num) {
117
34.2k
    func_inst = &_.ordered_instructions()[inst_num];
118
34.2k
    if (func_inst->opcode() == spv::Op::OpFunction) {
119
19.5k
      break;
120
19.5k
    } else if (func_inst->opcode() == spv::Op::OpFunctionParameter) {
121
14.5k
      ++param_index;
122
14.5k
    }
123
34.2k
  }
124
125
19.5k
  if (func_inst->opcode() != spv::Op::OpFunction) {
126
0
    return _.diag(SPV_ERROR_INVALID_LAYOUT, inst)
127
0
           << "Function parameter must be preceded by a function.";
128
0
  }
129
130
19.5k
  const auto function_type_id = func_inst->GetOperandAs<uint32_t>(3);
131
19.5k
  const auto function_type = _.FindDef(function_type_id);
132
19.5k
  if (!function_type) {
133
0
    return _.diag(SPV_ERROR_INVALID_ID, func_inst)
134
0
           << "Missing function type definition.";
135
0
  }
136
19.5k
  if (param_index >= function_type->words().size() - 3) {
137
4
    return _.diag(SPV_ERROR_INVALID_ID, inst)
138
4
           << "Too many OpFunctionParameters for " << func_inst->id()
139
4
           << ": expected " << function_type->words().size() - 3
140
4
           << " based on the function's type";
141
4
  }
142
143
19.5k
  const auto param_type =
144
19.5k
      _.FindDef(function_type->GetOperandAs<uint32_t>(param_index + 2));
145
19.5k
  if (!param_type || inst->type_id() != param_type->id()) {
146
18
    return _.diag(SPV_ERROR_INVALID_ID, inst)
147
18
           << "OpFunctionParameter Result Type <id> "
148
18
           << _.getIdName(inst->type_id())
149
18
           << " does not match the OpTypeFunction parameter "
150
18
              "type of the same index.";
151
18
  }
152
153
19.5k
  return SPV_SUCCESS;
154
19.5k
}
155
156
spv_result_t ValidateFunctionCall(ValidationState_t& _,
157
33.4k
                                  const Instruction* inst) {
158
33.4k
  const auto function_id = inst->GetOperandAs<uint32_t>(2);
159
33.4k
  const auto function = _.FindDef(function_id);
160
33.4k
  if (!function || spv::Op::OpFunction != function->opcode()) {
161
11
    return _.diag(SPV_ERROR_INVALID_ID, inst)
162
11
           << "OpFunctionCall Function <id> " << _.getIdName(function_id)
163
11
           << " is not a function.";
164
11
  }
165
166
33.4k
  auto return_type = _.FindDef(function->type_id());
167
33.4k
  if (!return_type || return_type->id() != inst->type_id()) {
168
11
    return _.diag(SPV_ERROR_INVALID_ID, inst)
169
11
           << "OpFunctionCall Result Type <id> " << _.getIdName(inst->type_id())
170
11
           << "s type does not match Function <id> "
171
11
           << _.getIdName(return_type->id()) << "s return type.";
172
11
  }
173
33.4k
  if (!_.options()->relax_logical_pointer &&
174
33.4k
      (_.addressing_model() == spv::AddressingModel::Logical ||
175
33.3k
       _.addressing_model() == spv::AddressingModel::PhysicalStorageBuffer64)) {
176
33.3k
    if (return_type->opcode() == spv::Op::OpTypePointer ||
177
33.3k
        return_type->opcode() == spv::Op::OpTypeUntypedPointerKHR) {
178
2
      const auto sc = return_type->GetOperandAs<spv::StorageClass>(1);
179
2
      if (sc != spv::StorageClass::PhysicalStorageBuffer) {
180
2
        if (!_.HasCapability(spv::Capability::VariablePointersStorageBuffer) &&
181
2
            sc == spv::StorageClass::StorageBuffer) {
182
0
          return _.diag(SPV_ERROR_INVALID_ID, inst)
183
0
                 << "In Logical addressing, functions may only return a "
184
0
                    "storage buffer pointer if the "
185
0
                    "VariablePointersStorageBuffer capability is declared";
186
2
        } else if (!_.HasCapability(spv::Capability::VariablePointers) &&
187
2
                   sc == spv::StorageClass::Workgroup) {
188
1
          return _.diag(SPV_ERROR_INVALID_ID, inst)
189
1
                 << "In Logical addressing, functions may only return a "
190
1
                    "workgroup pointer if the VariablePointers capability is "
191
1
                    "declared";
192
1
        } else if (sc != spv::StorageClass::StorageBuffer &&
193
1
                   sc != spv::StorageClass::Workgroup) {
194
1
          return _.diag(SPV_ERROR_INVALID_ID, inst)
195
1
                 << "In Logical addressing, functions may not return a pointer "
196
1
                    "in this storage class";
197
1
        }
198
2
      }
199
2
    }
200
33.3k
  }
201
202
33.4k
  const auto function_type_id = function->GetOperandAs<uint32_t>(3);
203
33.4k
  const auto function_type = _.FindDef(function_type_id);
204
33.4k
  if (!function_type || function_type->opcode() != spv::Op::OpTypeFunction) {
205
3
    return _.diag(SPV_ERROR_INVALID_ID, inst)
206
3
           << "Missing function type definition.";
207
3
  }
208
209
33.4k
  const auto function_call_arg_count = inst->words().size() - 4;
210
33.4k
  const auto function_param_count = function_type->words().size() - 3;
211
33.4k
  if (function_param_count != function_call_arg_count) {
212
3
    return _.diag(SPV_ERROR_INVALID_ID, inst)
213
3
           << "OpFunctionCall Function <id>'s parameter count does not match "
214
3
              "the argument count.";
215
3
  }
216
217
33.4k
  for (size_t argument_index = 3, param_index = 2;
218
82.9k
       argument_index < inst->operands().size();
219
49.5k
       argument_index++, param_index++) {
220
49.5k
    const auto argument_id = inst->GetOperandAs<uint32_t>(argument_index);
221
49.5k
    const auto argument = _.FindDef(argument_id);
222
49.5k
    if (!argument) {
223
0
      return _.diag(SPV_ERROR_INVALID_ID, inst)
224
0
             << "Missing argument " << argument_index - 3 << " definition.";
225
0
    }
226
227
49.5k
    const auto argument_type = _.FindDef(argument->type_id());
228
49.5k
    if (!argument_type) {
229
4
      return _.diag(SPV_ERROR_INVALID_ID, inst)
230
4
             << "Missing argument " << argument_index - 3
231
4
             << " type definition.";
232
4
    }
233
234
49.5k
    const auto parameter_type_id =
235
49.5k
        function_type->GetOperandAs<uint32_t>(param_index);
236
49.5k
    const auto parameter_type = _.FindDef(parameter_type_id);
237
49.5k
    if (!parameter_type || argument_type->id() != parameter_type->id()) {
238
22
      if (!parameter_type || !_.options()->before_hlsl_legalization ||
239
22
          !DoPointeesLogicallyMatch(argument_type, parameter_type, _)) {
240
22
        return _.diag(SPV_ERROR_INVALID_ID, inst)
241
22
               << "OpFunctionCall Argument <id> " << _.getIdName(argument_id)
242
22
               << "s type does not match Function <id> "
243
22
               << _.getIdName(parameter_type_id) << "s parameter type.";
244
22
      }
245
22
    }
246
247
49.5k
    if (_.addressing_model() == spv::AddressingModel::Logical ||
248
49.5k
        _.addressing_model() == spv::AddressingModel::PhysicalStorageBuffer64) {
249
49.5k
      if ((parameter_type->opcode() == spv::Op::OpTypePointer ||
250
233
           parameter_type->opcode() == spv::Op::OpTypeUntypedPointerKHR) &&
251
49.2k
          !_.options()->relax_logical_pointer) {
252
49.2k
        spv::StorageClass sc =
253
49.2k
            parameter_type->GetOperandAs<spv::StorageClass>(1u);
254
49.2k
        if (sc != spv::StorageClass::PhysicalStorageBuffer) {
255
          // Validate which storage classes can be pointer operands.
256
49.2k
          switch (sc) {
257
0
            case spv::StorageClass::UniformConstant:
258
49.2k
            case spv::StorageClass::Function:
259
49.2k
            case spv::StorageClass::Private:
260
49.2k
            case spv::StorageClass::Workgroup:
261
49.2k
            case spv::StorageClass::AtomicCounter:
262
            // SPV_EXT_tile_image
263
49.2k
            case spv::StorageClass::TileImageEXT:
264
            // SPV_KHR_ray_tracing
265
49.2k
            case spv::StorageClass::ShaderRecordBufferKHR:
266
              // These are always allowed.
267
49.2k
              break;
268
0
            case spv::StorageClass::StorageBuffer:
269
0
              if (!_.features().variable_pointers) {
270
0
                return _.diag(SPV_ERROR_INVALID_ID, inst)
271
0
                       << "StorageBuffer pointer operand "
272
0
                       << _.getIdName(argument_id)
273
0
                       << " requires a variable pointers capability";
274
0
              }
275
0
              break;
276
4
            default:
277
4
              return _.diag(SPV_ERROR_INVALID_ID, inst)
278
4
                     << "Invalid storage class for pointer operand "
279
4
                     << _.getIdName(argument_id);
280
49.2k
          }
281
282
          // Validate memory object declaration requirements.
283
49.2k
          if (argument->opcode() != spv::Op::OpVariable &&
284
90
              argument->opcode() != spv::Op::OpUntypedVariableKHR &&
285
90
              argument->opcode() != spv::Op::OpFunctionParameter) {
286
6
            const bool ssbo_vptr =
287
6
                _.HasCapability(
288
6
                    spv::Capability::VariablePointersStorageBuffer) &&
289
0
                sc == spv::StorageClass::StorageBuffer;
290
6
            const bool wg_vptr =
291
6
                _.HasCapability(spv::Capability::VariablePointers) &&
292
0
                sc == spv::StorageClass::Workgroup;
293
6
            const bool uc_ptr = sc == spv::StorageClass::UniformConstant;
294
6
            if (!_.options()->before_hlsl_legalization && !ssbo_vptr &&
295
6
                !wg_vptr && !uc_ptr) {
296
6
              return _.diag(SPV_ERROR_INVALID_ID, inst)
297
6
                     << "Pointer operand " << _.getIdName(argument_id)
298
6
                     << " must be a memory object declaration";
299
6
            }
300
6
          }
301
49.2k
        }
302
49.2k
      }
303
49.5k
    }
304
49.5k
  }
305
33.3k
  return SPV_SUCCESS;
306
33.4k
}
307
308
spv_result_t ValidateCooperativeMatrixPerElementOp(ValidationState_t& _,
309
0
                                                   const Instruction* inst) {
310
0
  const auto function_id = inst->GetOperandAs<uint32_t>(3);
311
0
  const auto function = _.FindDef(function_id);
312
0
  if (!function || spv::Op::OpFunction != function->opcode()) {
313
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
314
0
           << "OpCooperativeMatrixPerElementOpEXT Function <id> "
315
0
           << _.getIdName(function_id) << " is not a function.";
316
0
  }
317
318
0
  const auto matrix_id = inst->GetOperandAs<uint32_t>(2);
319
0
  const auto matrix = _.FindDef(matrix_id);
320
0
  const auto matrix_type_id = matrix->type_id();
321
0
  if (!_.IsCooperativeMatrixKHRType(matrix_type_id)) {
322
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
323
0
           << "OpCooperativeMatrixPerElementOpEXT Matrix <id> "
324
0
           << _.getIdName(matrix_id) << " is not a cooperative matrix.";
325
0
  }
326
327
0
  const auto result_type_id = inst->GetOperandAs<uint32_t>(0);
328
0
  if (matrix_type_id != result_type_id) {
329
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
330
0
           << "OpCooperativeMatrixPerElementOpEXT Result Type <id> "
331
0
           << _.getIdName(result_type_id) << " must match matrix type <id> "
332
0
           << _.getIdName(matrix_type_id) << ".";
333
0
  }
334
335
0
  const auto matrix_comp_type_id =
336
0
      _.FindDef(matrix_type_id)->GetOperandAs<uint32_t>(1);
337
0
  const auto function_type_id = function->GetOperandAs<uint32_t>(3);
338
0
  const auto function_type = _.FindDef(function_type_id);
339
0
  auto return_type_id = function_type->GetOperandAs<uint32_t>(1);
340
0
  if (return_type_id != matrix_comp_type_id) {
341
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
342
0
           << "OpCooperativeMatrixPerElementOpEXT function return type <id> "
343
0
           << _.getIdName(return_type_id)
344
0
           << " must match matrix component type <id> "
345
0
           << _.getIdName(matrix_comp_type_id) << ".";
346
0
  }
347
348
0
  if (function_type->operands().size() < 5) {
349
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
350
0
           << "OpCooperativeMatrixPerElementOpEXT function type <id> "
351
0
           << _.getIdName(function_type_id)
352
0
           << " must have at least three parameters.";
353
0
  }
354
355
0
  const auto param0_id = function_type->GetOperandAs<uint32_t>(2);
356
0
  const auto param1_id = function_type->GetOperandAs<uint32_t>(3);
357
0
  const auto param2_id = function_type->GetOperandAs<uint32_t>(4);
358
0
  if (!_.IsIntScalarType(param0_id, 32)) {
359
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
360
0
           << "OpCooperativeMatrixPerElementOpEXT function type first "
361
0
              "parameter "
362
0
              "type <id> "
363
0
           << _.getIdName(param0_id) << " must be a 32-bit integer.";
364
0
  }
365
366
0
  if (!_.IsIntScalarType(param1_id, 32)) {
367
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
368
0
           << "OpCooperativeMatrixPerElementOpEXT function type second "
369
0
              "parameter type <id> "
370
0
           << _.getIdName(param1_id) << " must be a 32-bit integer.";
371
0
  }
372
373
0
  if (param2_id != matrix_comp_type_id) {
374
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
375
0
           << "OpCooperativeMatrixPerElementOpEXT function type third "
376
0
              "parameter "
377
0
              "type <id> "
378
0
           << _.getIdName(param2_id) << " must match matrix component type.";
379
0
  }
380
381
0
  const auto optional_operand_count = inst->operands().size() - 4;
382
0
  const auto expected_function_type_operands = 5 + optional_operand_count;
383
0
  if (function_type->operands().size() != expected_function_type_operands) {
384
0
    return _.diag(SPV_ERROR_INVALID_ID, inst)
385
0
           << "OpCooperativeMatrixPerElementOpEXT function type <id> "
386
0
           << _.getIdName(function_type_id) << " must have "
387
0
           << (3 + optional_operand_count)
388
0
           << " parameters to match the instruction operands.";
389
0
  }
390
391
0
  for (uint32_t operand_index = 4; operand_index < inst->operands().size();
392
0
       ++operand_index) {
393
0
    const auto optional_operand_id =
394
0
        inst->GetOperandAs<uint32_t>(operand_index);
395
0
    const auto optional_operand = _.FindDef(optional_operand_id);
396
0
    const auto optional_operand_type_id =
397
0
        optional_operand ? optional_operand->type_id() : 0;
398
0
    const auto param_id =
399
0
        function_type->GetOperandAs<uint32_t>(operand_index + 1);
400
401
0
    if (!_.IsCooperativeMatrixType(optional_operand_type_id)) {
402
0
      if (param_id != optional_operand_type_id) {
403
0
        return _.diag(SPV_ERROR_INVALID_ID, inst)
404
0
               << "OpCooperativeMatrixPerElementOpEXT function type optional "
405
0
                  "parameter type <id> "
406
0
               << _.getIdName(param_id)
407
0
               << " must match optional operand type <id> "
408
0
               << _.getIdName(optional_operand_type_id) << ".";
409
0
      }
410
0
      continue;
411
0
    }
412
413
0
    if (optional_operand_type_id != matrix_type_id) {
414
0
      return _.diag(SPV_ERROR_INVALID_ID, inst)
415
0
             << "OpCooperativeMatrixPerElementOpEXT optional matrix operand "
416
0
                "type <id> "
417
0
             << _.getIdName(optional_operand_type_id)
418
0
             << " must match matrix type <id> " << _.getIdName(matrix_type_id)
419
0
             << ".";
420
0
    }
421
422
0
    const auto optional_matrix_comp_type_id =
423
0
        _.FindDef(optional_operand_type_id)->GetOperandAs<uint32_t>(1);
424
0
    if (param_id != optional_matrix_comp_type_id) {
425
0
      return _.diag(SPV_ERROR_INVALID_ID, inst)
426
0
             << "OpCooperativeMatrixPerElementOpEXT function type optional "
427
0
                "parameter type <id> "
428
0
             << _.getIdName(param_id)
429
0
             << " must match optional matrix component type.";
430
0
    }
431
0
  }
432
433
0
  return SPV_SUCCESS;
434
0
}
435
436
}  // namespace
437
438
14.9M
spv_result_t FunctionPass(ValidationState_t& _, const Instruction* inst) {
439
14.9M
  switch (inst->opcode()) {
440
43.4k
    case spv::Op::OpFunction:
441
43.4k
      if (auto error = ValidateFunction(_, inst)) return error;
442
43.3k
      break;
443
43.3k
    case spv::Op::OpFunctionParameter:
444
19.5k
      if (auto error = ValidateFunctionParameter(_, inst)) return error;
445
19.5k
      break;
446
33.4k
    case spv::Op::OpFunctionCall:
447
33.4k
      if (auto error = ValidateFunctionCall(_, inst)) return error;
448
33.3k
      break;
449
33.3k
    case spv::Op::OpCooperativeMatrixPerElementOpEXT:
450
0
      if (auto error = ValidateCooperativeMatrixPerElementOp(_, inst))
451
0
        return error;
452
0
      break;
453
14.8M
    default:
454
14.8M
      break;
455
14.9M
  }
456
457
14.9M
  return SPV_SUCCESS;
458
14.9M
}
459
460
}  // namespace val
461
}  // namespace spvtools