We're already checking that branch instructions are between the start
of the shader and the proper PROG_END sequence. The other thing we
need to make branching safe is to verify that the shader doesn't read
past the end of the uniforms stream.
To do that, we require that at any basic block reading uniforms have
the following instructions:
load_imm temp, <next offset within uniform stream>
add unif_addr, temp, unif
The instructions are generated by userspace, and the kernel verifies
that the load_imm is of the expected offset, and that the add adds it
to a uniform. We track which uniform in the stream that is, and at
draw call time fix up the uniform stream to have the address of the
start of the shader's uniforms at that location.
Signed-off-by: Eric Anholt <eric@anholt.net>
6d45c81d22