The loop is scanning until the original max_ip (size of the BO), but we want to not examine any code after the PROG_END's delay slots. There was a block trying to do that, except that we had some early continue statements if the signal wasn't a PROG_END or a BRANCH.
The failure mode would be that a valid shader is rejected because some undefined memory after the PROG_END slots is parsed as a branch and the rest of its setup is illegal. I haven't seen this in the wild, but
valgrind was complaining and the new userland simulator code started triggering it.
1d7874f vc4: Fix termination of the initial scan for branch targets.
.../drivers/vc4/kernel/vc4_validate_shaders.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
Upstream: cgit.freedesktop.org